commit 3d6cb6a2768514575dff75d70934ac6297e06eaf
author commit-queue@webkit.org <commit-queue@webkit.org@268f45cc-cd09-0410-ab3c-d52691b4dbfc> Wed Feb 03 06:34:06 2016 +0000
committer commit-queue@webkit.org <commit-queue@webkit.org@268f45cc-cd09-0410-ab3c-d52691b4dbfc> Wed Feb 03 06:34:06 2016 +0000
tree e68b6542426756712ab7096a308e8f128f95992b
parent 892a3ca066a084df3fa2257ea8c70a2d73a1607b

JSSymbolTableObject::deleteProperty() crashes deleting Symbols
https://bugs.webkit.org/show_bug.cgi?id=153816

Patch by Caitlin Potter <caitp@igalia.com> on 2016-02-02
Reviewed by Darin Adler.

Changes JSSymbolTableObject::deleteProperty() to check if its
symbolTable() contains the property's uid() rather than publicName().
This ensures that it will not crash in the case of Symbols.

* runtime/JSSymbolTableObject.cpp:
(JSC::JSSymbolTableObject::deleteProperty):
* tests/es6/Object_static_methods_Object.getOwnPropertyDescriptors.js:
(testGlobalProxy):
* tests/stress/regress-153816.js: Added.
(deleteSymbolFromJSSymbolTableObject):

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@196051 268f45cc-cd09-0410-ab3c-d52691b4dbfc