The following simple repro crashes on ToT, as well as in Safari 9: ``` var symbol = Symbol(""); window[symbol] = "crasher"; delete window[symbol]; // CRASH ``` Repro: https://jsfiddle.net/c820tLLt/
Created attachment 270543 [details] Patch
Comment on attachment 270543 [details] Patch View in context: https://bugs.webkit.org/attachment.cgi?id=270543&action=review > Source/JavaScriptCore/tests/stress/regress-153816.js:10 > + if (globalProxy[symbolProperty] !== undefined) > + throw new Error("bad value: " + String(globalProxy[symbolProperty])); Might also want to check "symbolProperty in globalProxy".
Created attachment 270545 [details] Patch
Created attachment 270546 [details] Patch
Comment on attachment 270543 [details] Patch View in context: https://bugs.webkit.org/attachment.cgi?id=270543&action=review >> Source/JavaScriptCore/tests/stress/regress-153816.js:10 >> + throw new Error("bad value: " + String(globalProxy[symbolProperty])); > > Might also want to check "symbolProperty in globalProxy". good point, done
Comment on attachment 270546 [details] Patch Clearing flags on attachment: 270546 Committed r196051: <http://trac.webkit.org/changeset/196051>
All reviewed patches have been landed. Closing bug.