PropertyCondition::isValidValueForAttributes() should check if the passed in value is a deleted one before it does a jsDynamicCast on it. <rdar://problem/41370337>
Created attachment 343372 [details] proposed patch.
Created attachment 343374 [details] proposed patch.
Created attachment 343375 [details] proposed patch.
Created attachment 343381 [details] proposed patch.
Comment on attachment 343381 [details] proposed patch. Thanks for the review.
Comment on attachment 343381 [details] proposed patch. Clearing flags on attachment: 343381 Committed r233114: <https://trac.webkit.org/changeset/233114>
All reviewed patches have been landed. Closing bug.