105468 – JSObject::ensure<IndexingType> should gracefully handle InterceptsGetOwn..., and should never be called when the 'this' is not an object

RESOLVED FIXED105468

JSObject::ensure<IndexingType> should gracefully handle InterceptsGetOwn..., and should never be called when the 'this' is not an object

https://bugs.webkit.org/show_bug.cgi?id=105468

Summary JSObject::ensure<IndexingType> should gracefully handle InterceptsGetOwn..., ...

Filip Pizlo

Reported 2012-12-19 15:00:31 PST

This fixes situations where we end up doing crazy when a string flows into a DFG Arrayify

Attachments
the patch (71.50 KB, patch) 2012-12-19 15:56 PST, Filip Pizlo	oliver: review+	Details Formatted Diff Diff
View All Add attachment proposed patch, testcase, etc.

Filip Pizlo

Comment 1 2012-12-19 15:56:37 PST

Filip Pizlo

Comment 2 2012-12-19 16:21:39 PST

Note You need to log in before you can comment on or make changes to this bug.

Status RESOLVED

Resolution FIXED

Priority P2

Severity Normal

Classification Unclassified

Version 528+ (Nightly build)

Hardware All

OS All

Product WebKit

Component JavaScriptCore

Assignee

Filip Pizlo

Reported

2012-12-19 15:00 PST

Modified

2012-12-19 16:21 PST History

CC List

7 users Show

URL

Keywords

Depends on

Blocks