tree bb9ddac3f448a99d63d3dda7694a4257ec240fa3
parent 73559930a6418bc4621c1c5774b11e1be9c21a8f
author sbarati@apple.com <sbarati@apple.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc> 1571700217 +0000
committer sbarati@apple.com <sbarati@apple.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc> 1571700217 +0000

JSON.parse has bad is array assert
https://bugs.webkit.org/show_bug.cgi?id=203207
<rdar://problem/56366913>

Reviewed by Yusuke Suzuki.

JSTests:

* stress/json-parse-array-prototype-is-array-assert.js: Added.
(assert):

Source/JavaScriptCore:

In r250860, we updated JSON.parse to be more spec compliant with how it
handles arrays. However, we also updated an assertion in an improper way,
where our assert was not accounting for the check we performed to take
that control flow path.

* runtime/JSONObject.cpp:
(JSC::Walker::walk):


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@251394 268f45cc-cd09-0410-ab3c-d52691b4dbfc