Otherwise, we may crash in removing a predecessor, since predecessor list is now also deduplicated.
This should fix the crash on this test: js/dom/JSON-stringify.html introduced by https://trac.webkit.org/changeset/232741/webkit
Created attachment 342622 [details] patch I'm in the middle of building, so I still need to test this, but I'm pretty sure it's the correct fix.
Comment on attachment 342622 [details] patch I've confirmed this fixes the crash.
LGTM, but I'm not an official reviewer.
Pinging reviewers. We need the fix ASAP as this is affecting EWS.
Comment on attachment 342622 [details] patch Clearing flags on attachment: 342622 Committed r232800: <https://trac.webkit.org/changeset/232800>
All reviewed patches have been landed. Closing bug.
<rdar://problem/41097203>
I think ARES-6 is still crashing. https://arewefastyet.com/#machine=29&view=breakdown&suite=ares6
(In reply to Yusuke Suzuki from comment #9) > I think ARES-6 is still crashing. > https://arewefastyet.com/#machine=29&view=breakdown&suite=ares6 Michael is working on a fix
(In reply to Saam Barati from comment #10) > (In reply to Yusuke Suzuki from comment #9) > > I think ARES-6 is still crashing. > > https://arewefastyet.com/#machine=29&view=breakdown&suite=ares6 > > Michael is working on a fix Nice!