Currently JSObject::tryGetIndexQuickly() triggers an assertion failure when the indexing type of an object is ArrayWithUndecided. This case is currently not handled but should be treated the same as a blank indexing type.
Created attachment 173521 [details] Fix assertion failure in JSObject::tryGetIndexQuickly()
Comment on attachment 173521 [details] Fix assertion failure in JSObject::tryGetIndexQuickly() If it was possible to add a test case to LayoutTests, then that would be super awesome. R=me for the patch as-is and RS=me for a test.
Btw, if you want to land the patch then set 'cq' to '?'.
Created attachment 173556 [details] Fix assertion failure in JSObject::tryGetIndexQuickly() I've updated the original patch with a test case.
Comment on attachment 173556 [details] Fix assertion failure in JSObject::tryGetIndexQuickly() Clearing flags on attachment: 173556 Committed r134193: <http://trac.webkit.org/changeset/134193>
All reviewed patches have been landed. Closing bug.