poc.js ``` let map = new Map(); function v5() { function v10() { function v11() { const v12 = v5(); return null; } const handler = { getPrototypeOf:v11 }; const p = new Proxy(map,handler); map.__proto__ = p; const v16 = v10(); } try { const v17 = v10(); } catch(e) { //print(e); } } const v19 = v5(); ``` execution result: ASSERTION FAILED: baseValue.asCell()->structure(vm) == structure ../../Source/JavaScriptCore/jit/Repatch.cpp(468) : JSC::InlineCacheAction JSC::tryCachePutByID(JSC::ExecState *, JSC::JSValue, JSC::Structure *, const JSC::Identifier &, const JSC::PutPropertySlot &, JSC::StructureStubInfo &, JSC::PutKind) [1] 17017 abort (core dumped) /media/hdd/WebKit-git/webkit_build_825bbd0_20190704/Debug/bin/jsc
<rdar://problem/53854946>
patch forthcoming
Created attachment 378698 [details] patch
Comment on attachment 378698 [details] patch View in context: https://bugs.webkit.org/attachment.cgi?id=378698&action=review r=me > Source/JavaScriptCore/runtime/JSObject.cpp:841 > + if (obj->type() == ProxyObjectType) { Can you fix ordinarySetSlow too?
(In reply to Yusuke Suzuki from comment #4) > Comment on attachment 378698 [details] > patch > > View in context: > https://bugs.webkit.org/attachment.cgi?id=378698&action=review > > r=me > > > Source/JavaScriptCore/runtime/JSObject.cpp:841 > > + if (obj->type() == ProxyObjectType) { > > Can you fix ordinarySetSlow too? Good call. Fixed and added a test
Created attachment 378700 [details] patch for landing
Comment on attachment 378700 [details] patch for landing Attachment 378700 [details] did not pass jsc-ews (mac): Output: https://webkit-queues.webkit.org/results/13027855 New failing tests: mozilla-tests.yaml/js1_5/Array/regress-101964.js.mozilla-ftl-eager-no-cjit-validate-phases
The test is flaky. It's not this patch
Comment on attachment 378700 [details] patch for landing Clearing flags on attachment: 378700 Committed r249911: <https://trac.webkit.org/changeset/249911>
All reviewed patches have been landed. Closing bug.
*** Bug 202342 has been marked as a duplicate of this bug. ***
*** Bug 202624 has been marked as a duplicate of this bug. ***