Unreviwed, add a comment to describe the test's failure mode. Suggested by mlam.
authorfpizlo@apple.com <fpizlo@apple.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Tue, 24 May 2016 19:04:24 +0000 (19:04 +0000)
committerfpizlo@apple.com <fpizlo@apple.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Tue, 24 May 2016 19:04:24 +0000 (19:04 +0000)
* tests/stress/override-map-constructor.js:
(Map):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@201342 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Source/JavaScriptCore/ChangeLog
Source/JavaScriptCore/tests/stress/override-map-constructor.js

index db31037..011e9d4 100644 (file)
@@ -1,5 +1,12 @@
 2016-05-24  Filip Pizlo  <fpizlo@apple.com>
 
+        Unreviwed, add a comment to describe the test's failure mode. Suggested by mlam.
+
+        * tests/stress/override-map-constructor.js:
+        (Map):
+
+2016-05-24  Filip Pizlo  <fpizlo@apple.com>
+
         Map should not be in JSGlobalObject's static hashtable because it's initialized eagerly via FOR_EACH_SIMPLE_BUILTIN_TYPE_WITH_CONSTRUCTOR
         https://bugs.webkit.org/show_bug.cgi?id=158031
         rdar://problem/26353661
index d98fa5a..a5c9b4b 100644 (file)
@@ -1,2 +1,4 @@
+// This used to crash because overriding Map as a variable, not property, would trigger a bug in getOwnPropertySlot.
+
 function Map() {
 }