...
Created attachment 383009 [details] Patch
Created attachment 383098 [details] Patch
Created attachment 383099 [details] Patch
Comment on attachment 383099 [details] Patch View in context: https://bugs.webkit.org/attachment.cgi?id=383099&action=review r=me with comments. > Source/JavaScriptCore/runtime/JSGlobalObject.cpp:2015 > + if (m_mapIteratorProtocolWatchpointSet.isStillValid()) { Can't this be an ASSERT? How can this not be valid if you haven't initialized Map.prototype? I don't think it's possible to access the Map iterator prototype object without first creating a Map. > Source/JavaScriptCore/runtime/JSGlobalObject.cpp:2030 > + if (m_setIteratorProtocolWatchpointSet.isStillValid()) { ditto.
Comment on attachment 383099 [details] Patch View in context: https://bugs.webkit.org/attachment.cgi?id=383099&action=review Thanks! >> Source/JavaScriptCore/runtime/JSGlobalObject.cpp:2015 >> + if (m_mapIteratorProtocolWatchpointSet.isStillValid()) { > > Can't this be an ASSERT? How can this not be valid if you haven't initialized Map.prototype? I don't think it's possible to access the Map iterator prototype object without first creating a Map. This can be invalid because m_mapIteratorProtocolWatchpointSet is also checked by mapIteratorPrototype's change. > Source/JavaScriptCore/runtime/JSGlobalObject.cpp:2020 > + if (m_mapSetWatchpointSet.isStillValid()) { On the other hand, this is only used here. So we can convert it to ASSERT. Fixed. >> Source/JavaScriptCore/runtime/JSGlobalObject.cpp:2030 >> + if (m_setIteratorProtocolWatchpointSet.isStillValid()) { > > ditto. Ditto. This can be invalid if setIteratorPrototype is changed. > Source/JavaScriptCore/runtime/JSGlobalObject.cpp:2035 > + if (m_setAddWatchpointSet.isStillValid()) { Ditto. Fixed.
Committed r252256: <https://trac.webkit.org/changeset/252256>
<rdar://problem/57031944>