Bug 186943

Summary: PropertyCondition::isValidValueForAttributes() should also consider deleted values.
Product: WebKit Reporter: Mark Lam <mark.lam>
Component: JavaScriptCoreAssignee: Mark Lam <mark.lam>
Status: RESOLVED FIXED    
Severity: Normal CC: commit-queue, fpizlo, keith_miller, msaboff, rmorisset, saam, tzagallo, webkit-bug-importer
Priority: P2 Keywords: InRadar
Version: WebKit Nightly Build   
Hardware: Unspecified   
OS: Unspecified   
Attachments:
Description Flags
proposed patch.
none
proposed patch.
none
proposed patch.
none
proposed patch. none

Description Mark Lam 2018-06-22 14:47:44 PDT 
PropertyCondition::isValidValueForAttributes() should check if the passed in value is a deleted one before it does a jsDynamicCast on it.

<rdar://problem/41370337>
Comment 1 Mark Lam 2018-06-22 15:02:19 PDT 
Created attachment 343372 [details]
proposed patch.
Comment 2 Mark Lam 2018-06-22 15:20:15 PDT 
Created attachment 343374 [details]
proposed patch.
Comment 3 Mark Lam 2018-06-22 15:31:04 PDT 
Created attachment 343375 [details]
proposed patch.
Comment 4 Mark Lam 2018-06-22 15:45:41 PDT 
Created attachment 343381 [details]
proposed patch.
Comment 5 Mark Lam 2018-06-22 17:17:47 PDT 
Comment on attachment 343381 [details]
proposed patch.

Thanks for the review.
Comment 6 WebKit Commit Bot 2018-06-22 17:45:12 PDT 
Comment on attachment 343381 [details]
proposed patch.

Clearing flags on attachment: 343381

Committed r233114: <https://trac.webkit.org/changeset/233114>
Comment 7 WebKit Commit Bot 2018-06-22 17:45:14 PDT 
All reviewed patches have been landed.  Closing bug.