Assertion used to determine if something is an async generator is wrong
authorsbarati@apple.com <sbarati@apple.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Thu, 28 Dec 2017 18:13:15 +0000 (18:13 +0000)
committersbarati@apple.com <sbarati@apple.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Thu, 28 Dec 2017 18:13:15 +0000 (18:13 +0000)
commit668fa696b988469c4ca2891156fece069e6b5fac
treeb8eac99c24bddcb01d65399f35c06089ac164cfe
parentf9145241dcd278042394c668630053852b9045ec
Assertion used to determine if something is an async generator is wrong
https://bugs.webkit.org/show_bug.cgi?id=181168
<rdar://problem/35640560>

Reviewed by Yusuke Suzuki.

JSTests:

* stress/async-generator-assertion.js: Added.

Source/JavaScriptCore:

Previous assertions were doing a get on the base value for @@asyncIterator.
This symbol is defined on AsyncGeneratorPrototype. The base value may change
its prototype, but it's still an async generator as far as our system is
concerned. This patch updates the assertion to check for a private property
on the base value.

* builtins/AsyncGeneratorPrototype.js:
(globalPrivate.asyncGeneratorReject):
(globalPrivate.asyncGeneratorResolve):
(globalPrivate.asyncGeneratorResumeNext):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@226305 268f45cc-cd09-0410-ab3c-d52691b4dbfc
JSTests/ChangeLog
JSTests/stress/async-generator-assertion.js [new file with mode: 0644]
Source/JavaScriptCore/ChangeLog
Source/JavaScriptCore/builtins/AsyncGeneratorPrototype.js