RESOLVED FIXED 187060
ASSERTION FAILED: length > butterfly->vectorLength() in JSObject::ensureLengthSlow(). 
https://bugs.webkit.org/show_bug.cgi?id=187060
Summary ASSERTION FAILED: length > butterfly->vectorLength() in JSObject::ensureLengt...
Mark Lam
Reported 2018-06-26 12:30:15 PDT
<rdar://problem/41452767>
Attachments
proposed patch. (2.61 KB, patch)
2018-06-26 12:35 PDT, Mark Lam 		no flags
DetailsFormatted DiffDiff
View All Add attachment proposed patch, testcase, etc.
Mark Lam
Comment 1 2018-06-26 12:35:58 PDT
Created attachment 343630 [details] proposed patch.
Keith Miller
Comment 2 2018-06-26 12:38:35 PDT
Comment on attachment 343630 [details] proposed patch. r=me.
Mark Lam
Comment 3 2018-06-26 13:10:34 PDT
Comment on attachment 343630 [details] proposed patch. Thanks for the review. Landing.
WebKit Commit Bot
Comment 4 2018-06-26 13:37:36 PDT
Comment on attachment 343630 [details] proposed patch. Clearing flags on attachment: 343630 Committed r233217: <https://trac.webkit.org/changeset/233217>
WebKit Commit Bot
Comment 5 2018-06-26 13:37:38 PDT
All reviewed patches have been landed. Closing bug.
Note You need to log in before you can comment on or make changes to this bug.