The following code in Source/JavaScriptCore/runtime/JSFunction.cpp, added in 2011, could use some investigation/auditing: ``` // This will trigger the property to be reified, if this is not already the case! bool okay = thisObject->hasProperty(exec, propertyName); ASSERT_UNUSED(okay, okay); scope.release(); return Base::put(thisObject, exec, propertyName, value, slot); ``` It's unclear what the purpose of reifying this is, as the properties in question are not lazy. Base::put() ought to be enough.
It turns out that not only is this not needed, this weird behavior is causing observable side effects.
<rdar://problem/35455798>
Created attachment 329211 [details] patch
There's a chance I need to update test262 test expectations.
Comment on attachment 329211 [details] patch r=me
Comment on attachment 329211 [details] patch Clearing flags on attachment: 329211 Committed r225845: <https://trac.webkit.org/changeset/225845>
All reviewed patches have been landed. Closing bug.
👏🙌
*** Bug 157461 has been marked as a duplicate of this bug. ***