Bug 153816 – JSSymbolTableObject::deleteProperty() crashes deleting Symbols

• Status: RESOLVED
• Resolution: FIXED
• Component: JavaScriptCore

[Caitlin Potter (:caitp)]

The following simple repro crashes on ToT, as well as in Safari 9:

```
var symbol = Symbol("");
window[symbol] = "crasher";
delete window[symbol]; // CRASH
```

Repro: https://jsfiddle.net/c820tLLt/

[Caitlin Potter (:caitp)]

Created attachment 270543 [details]
Patch

[Darin Adler]

Comment on attachment 270543 [details]
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=270543&action=review

> Source/JavaScriptCore/tests/stress/regress-153816.js:10
> +    if (globalProxy[symbolProperty] !== undefined)
> +        throw new Error("bad value: " + String(globalProxy[symbolProperty]));

Might also want to check "symbolProperty in globalProxy".

[Caitlin Potter (:caitp)]

Created attachment 270545 [details]
Patch

[Caitlin Potter (:caitp)]

Created attachment 270546 [details]
Patch

[Caitlin Potter (:caitp)]

Comment on attachment 270543 [details]
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=270543&action=review

>> Source/JavaScriptCore/tests/stress/regress-153816.js:10
>> +        throw new Error("bad value: " + String(globalProxy[symbolProperty]));
> 
> Might also want to check "symbolProperty in globalProxy".

good point, done

[WebKit Commit Bot]

Comment on attachment 270546 [details]
Patch

Clearing flags on attachment: 270546

Committed r196051: <http://trac.webkit.org/changeset/196051>

[WebKit Commit Bot]

All reviewed patches have been landed.  Closing bug.