Changeset 202528 in webkit

Timestamp:

Jun 27, 2016 5:42:26 PM (8 years ago)

Author:

keith_miller@apple.com

Message:

Fix bad assert in StructureRareData::setObjectToStringValue
​https://bugs.webkit.org/show_bug.cgi?id=159171
<rdar://problem/26987355>

Reviewed by Mark Lam.

We should not have expected the generateConditionsForPrototypePropertyHit would succeed.
There are many reasons it might fail including that there is a proxy somewhere on the
prototype chain of the object.

• runtime/StructureRareData.cpp:

(JSC::StructureRareData::setObjectToStringValue):

• tests/stress/object-toString-with-proxy.js: Added.

(get target):

Location:

trunk/Source/JavaScriptCore

Files:

• ChangeLog (modified) (1 diff)
• runtime/StructureRareData.cpp (modified) (1 diff)
• tests/stress/object-toString-with-proxy.js (added)

trunk/Source/JavaScriptCore/ChangeLog

@@ +1 @@
+2016-06-27  Keith Miller  <keith_miller@apple.com>
+
+        Fix bad assert in StructureRareData::setObjectToStringValue
+        https://bugs.webkit.org/show_bug.cgi?id=159171
+        <rdar://problem/26987355>
+
+        Reviewed by Mark Lam.
+
+        We should not have expected the generateConditionsForPrototypePropertyHit would succeed.
+        There are many reasons it might fail including that there is a proxy somewhere on the
+        prototype chain of the object.
+
+        * runtime/StructureRareData.cpp:
+        (JSC::StructureRareData::setObjectToStringValue):
+        * tests/stress/object-toString-with-proxy.js: Added.
+        (get target):
+
 2016-06-27  Filip Pizlo  <fpizlo@apple.com>
 

trunk/Source/JavaScriptCore/runtime/StructureRareData.cpp

@@ -127 +127 @@
         // is not on the ownStructure so we will transisition if one is added and this cache will no longer be used.
         conditionSet = generateConditionsForPrototypePropertyHit(vm, this, exec, ownStructure, toStringTagSymbolSlot.slotBase(), vm.propertyNames->toStringTagSymbol.impl());
-        ASSERT(conditionSet.hasOneSlotBaseCondition());
+        ASSERT(!conditionSet.isValid() || conditionSet.hasOneSlotBaseCondition());
     } else if (toStringTagSymbolSlot.isUnset())
         conditionSet = generateConditionsForPropertyMiss(vm, this, exec, ownStructure, vm.propertyNames->toStringTagSymbol.impl());