RESOLVED FIXED 192770
Fix stale assertion in attemptToForceStringArrayModeByToStringConversion(). 
https://bugs.webkit.org/show_bug.cgi?id=192770
Summary Fix stale assertion in attemptToForceStringArrayModeByToStringConversion().
Mark Lam
Reported 2018-12-17 12:17:13 PST
<rdar://problem/46449037>
Attachments
proposed patch. (2.70 KB, patch)
2018-12-17 12:22 PST, Mark Lam 		keith_miller: review+
DetailsFormatted DiffDiff
View All Add attachment proposed patch, testcase, etc.
Mark Lam
Comment 1 2018-12-17 12:22:47 PST
Created attachment 357466 [details] proposed patch.
Keith Miller
Comment 2 2018-12-17 12:52:12 PST
Comment on attachment 357466 [details] proposed patch. View in context: https://bugs.webkit.org/attachment.cgi?id=357466&action=review r=me. > JSTests/ChangeLog:9 > + * stress/regress-192770.js: Added. Nit: Can we give this a real name? I kinda hate the "regress-<unclear number>.js" convention.
Mark Lam
Comment 3 2018-12-17 13:01:12 PST
Thanks for the review. (In reply to Keith Miller from comment #2) > Comment on attachment 357466 [details] > proposed patch. > > View in context: > https://bugs.webkit.org/attachment.cgi?id=357466&action=review > > r=me. > > > JSTests/ChangeLog:9 > > + * stress/regress-192770.js: Added. > > Nit: Can we give this a real name? I kinda hate the "regress-<unclear > number>.js" convention. Will rename to force-string-arrayMode-on-originalNonArray-array-class.js.
Mark Lam
Comment 4 2018-12-17 13:33:10 PST
Landed in r239287: <http://trac.webkit.org/r239287>.
Note You need to log in before you can comment on or make changes to this bug.