ASSERTION FAILED: pair.second->m_type & PropertyNode::Getter
authormark.lam@apple.com <mark.lam@apple.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Tue, 9 Jan 2018 18:49:25 +0000 (18:49 +0000)
committermark.lam@apple.com <mark.lam@apple.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Tue, 9 Jan 2018 18:49:25 +0000 (18:49 +0000)
commitb192cfaf006507373862cead5a837be8f0efdd76
treefc10c558bfe42ff2927fa3685b0069e95a8cd581
parent08f0b71561f24f238302001c649d92b2890c1ac5
ASSERTION FAILED: pair.second->m_type & PropertyNode::Getter
https://bugs.webkit.org/show_bug.cgi?id=181388
<rdar://problem/36349351>

Reviewed by Saam Barati.

JSTests:

* stress/regress-181388.js: Added.

Source/JavaScriptCore:

When there are duplicate setters or getters, we may end up overwriting a getter
with a setter, or vice versa.  This patch adds tracking for getters/setters that
have been overwritten with duplicates and ignore them.

* bytecompiler/NodesCodegen.cpp:
(JSC::PropertyListNode::emitBytecode):
* parser/NodeConstructors.h:
(JSC::PropertyNode::PropertyNode):
* parser/Nodes.h:
(JSC::PropertyNode::isOverriddenByDuplicate const):
(JSC::PropertyNode::setIsOverriddenByDuplicate):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@226650 268f45cc-cd09-0410-ab3c-d52691b4dbfc
JSTests/ChangeLog
JSTests/stress/regress-181388.js [new file with mode: 0644]
Source/JavaScriptCore/ChangeLog
Source/JavaScriptCore/bytecompiler/NodesCodegen.cpp
Source/JavaScriptCore/parser/NodeConstructors.h
Source/JavaScriptCore/parser/Nodes.h