Title: [201342] trunk/Source/_javascript_Core
- Revision
- 201342
- Author
- [email protected]
- Date
- 2016-05-24 12:04:24 -0700 (Tue, 24 May 2016)
Log Message
Unreviwed, add a comment to describe the test's failure mode. Suggested by mlam.
* tests/stress/override-map-constructor.js:
(Map):
Modified Paths
Diff
Modified: trunk/Source/_javascript_Core/ChangeLog (201341 => 201342)
--- trunk/Source/_javascript_Core/ChangeLog 2016-05-24 19:03:42 UTC (rev 201341)
+++ trunk/Source/_javascript_Core/ChangeLog 2016-05-24 19:04:24 UTC (rev 201342)
@@ -1,5 +1,12 @@
2016-05-24 Filip Pizlo <[email protected]>
+ Unreviwed, add a comment to describe the test's failure mode. Suggested by mlam.
+
+ * tests/stress/override-map-constructor.js:
+ (Map):
+
+2016-05-24 Filip Pizlo <[email protected]>
+
Map should not be in JSGlobalObject's static hashtable because it's initialized eagerly via FOR_EACH_SIMPLE_BUILTIN_TYPE_WITH_CONSTRUCTOR
https://bugs.webkit.org/show_bug.cgi?id=158031
rdar://problem/26353661
Modified: trunk/Source/_javascript_Core/tests/stress/override-map-constructor.js (201341 => 201342)
--- trunk/Source/_javascript_Core/tests/stress/override-map-constructor.js 2016-05-24 19:03:42 UTC (rev 201341)
+++ trunk/Source/_javascript_Core/tests/stress/override-map-constructor.js 2016-05-24 19:04:24 UTC (rev 201342)
@@ -1,2 +1,4 @@
+// This used to crash because overriding Map as a variable, not property, would trigger a bug in getOwnPropertySlot.
+
function Map() {
}
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes
