REGRESSION(r200383): Setting lazily initialized properties across frame boundaries...
authorfpizlo@apple.com <fpizlo@apple.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Wed, 4 May 2016 05:01:08 +0000 (05:01 +0000)
committerfpizlo@apple.com <fpizlo@apple.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Wed, 4 May 2016 05:01:08 +0000 (05:01 +0000)
commit72f16e4c8609294d0820bbdd2741281aedafdc1d
treeb4e971e84a3f88fc7d55bd832fbe642eb5fb4660
parentfaf049d1a98f426127cabf0cf5e0892286ad234e
REGRESSION(r200383): Setting lazily initialized properties across frame boundaries crashes
https://bugs.webkit.org/show_bug.cgi?id=157333

Reviewed by Benjamin Poulain.

Source/JavaScriptCore:

I forgot to add logic for lazy properties in putEntry(). It turns out that it's easy to
add.

* runtime/Lookup.h:
(JSC::putEntry):
* runtime/PropertySlot.h:

LayoutTests:

This is JoePeck's original test case. It used to crash and now it doesn't crash anymore.

* js/dom/cross-window-put-math-expected.txt: Added.
* js/dom/cross-window-put-math.html: Added.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@200406 268f45cc-cd09-0410-ab3c-d52691b4dbfc
LayoutTests/ChangeLog
LayoutTests/js/dom/cross-window-put-math-expected.txt [new file with mode: 0644]
LayoutTests/js/dom/cross-window-put-math.html [new file with mode: 0644]
Source/JavaScriptCore/ChangeLog
Source/JavaScriptCore/runtime/Lookup.h
Source/JavaScriptCore/runtime/PropertySlot.h