Map should not be in JSGlobalObject's static hashtable because it's initialized eager...
authorfpizlo@apple.com <fpizlo@apple.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Tue, 24 May 2016 19:01:35 +0000 (19:01 +0000)
committerfpizlo@apple.com <fpizlo@apple.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Tue, 24 May 2016 19:01:35 +0000 (19:01 +0000)
commitb48118b4287396812bc4228f5090c744421c6eff
treeaa2b15f3d01527118fd7baee6a67eab1d171399a
parentf7f1ca79cf8b871861327eb34a5a1679effb6ab8
Map should not be in JSGlobalObject's static hashtable because it's initialized eagerly via FOR_EACH_SIMPLE_BUILTIN_TYPE_WITH_CONSTRUCTOR
https://bugs.webkit.org/show_bug.cgi?id=158031
rdar://problem/26353661

Reviewed by Geoffrey Garen.

We were listing Map as being a lazy class structure. It's not. m_mapStructure is a WriteBarrier<>
not a LazyClassStructure<> and there is nothing lazy about it.

* runtime/JSGlobalObject.cpp: The fix is to remove Map here.
* runtime/Lookup.cpp: Add some dumping on the assert path.
(JSC::setUpStaticFunctionSlot):
* tests/stress/override-map-constructor.js: Added. This test used to crash.
(Map):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@201340 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Source/JavaScriptCore/ChangeLog
Source/JavaScriptCore/runtime/JSGlobalObject.cpp
Source/JavaScriptCore/runtime/Lookup.cpp
Source/JavaScriptCore/tests/stress/override-map-constructor.js [new file with mode: 0644]