REGRESSION(r200383): Setting lazily initialized properties across frame boundaries crashes
https://bugs.webkit.org/show_bug.cgi?id=157333
Reviewed by Benjamin Poulain.
Source/JavaScriptCore:
I forgot to add logic for lazy properties in putEntry(). It turns out that it's easy to
add.
* runtime/Lookup.h:
(JSC::putEntry):
* runtime/PropertySlot.h:
LayoutTests:
This is JoePeck's original test case. It used to crash and now it doesn't crash anymore.
* js/dom/cross-window-put-math-expected.txt: Added.
* js/dom/cross-window-put-math.html: Added.
git-svn-id: http://svn.webkit.org/repository/webkit/trunk@200406 268f45cc-cd09-0410-ab3c-d52691b4dbfc
6 files changed