Created attachment 372860 [details] Patch

Comment on attachment 372860 [details] Patch View in context: https://bugs.webkit.org/attachment.cgi?id=372860&action=review > Source/WebCore/ChangeLog:9 > + This fixes some crashes related to checking that all prototypes have been > + marked as such to JSC. What crashes? I thought the assert got rolled out? And we were doing things in another way?

Comment on attachment 372860 [details] Patch View in context: https://bugs.webkit.org/attachment.cgi?id=372860&action=review >> Source/WebCore/ChangeLog:9 >> + marked as such to JSC. > > What crashes? I thought the assert got rolled out? And we were doing things in another way? Do you mean this will crash a future change? Can you be more specific here

Comment on attachment 372860 [details] Patch r=me too, and can we add this `didBecomePrototype()` call before calling setPrototypeWithoutTransition() in JSGlobalObject's m_functionPrototype thing too?

Comment on attachment 372860 [details] Patch View in context: https://bugs.webkit.org/attachment.cgi?id=372860&action=review >>> Source/WebCore/ChangeLog:9 >>> + marked as such to JSC. >> >> What crashes? I thought the assert got rolled out? And we were doing things in another way? > > Do you mean this will crash a future change? Can you be more specific here The patch in https://trac.webkit.org/changeset/246801 breaks debug builds right now because setPrototypeWithoutTransition looks for isValidPrototype. I'll update the ChangeLog to make this clearer.

Comment on attachment 372860 [details] Patch View in context: https://bugs.webkit.org/attachment.cgi?id=372860&action=review > Source/WebCore/bindings/js/JSWindowProxy.cpp:115 > + properties.didBecomePrototype(); > prototype->structure(vm)->setPrototypeWithoutTransition(vm, &properties); I thought we were going too make setPrototypeWithoutTransition() call didBecomePrototype() on the passed in prototype object. Was there a change of plans?

Comment on attachment 372860 [details] Patch restoring Saam's r+.

Comment on attachment 372860 [details] Patch View in context: https://bugs.webkit.org/attachment.cgi?id=372860&action=review >> Source/WebCore/bindings/js/JSWindowProxy.cpp:115 >> prototype->structure(vm)->setPrototypeWithoutTransition(vm, &properties); > > I thought we were going too make setPrototypeWithoutTransition() call didBecomePrototype() on the passed in prototype object. Was there a change of plans? No, we were going to do it on Structure::create because we know no objects already have that structure thus we don't need to check for haveABadTime. setPrototypeWithoutTransition() can modify existing objects thus haveABadTime should be enforced.

Committed r246808: <https://trac.webkit.org/changeset/246808>

<rdar://problem/52133576>

Reopening to attach new patch.

Created attachment 372862 [details] Patch

Should this be closed?