[webkit-changes] [WebKit/WebKit] a6eac1: Occasional debug assertion under IntlNumberFormat:...

[Wenson Hsieh]

  Branch: refs/heads/main
  Home:   https://github.com/WebKit/WebKit
  Commit: a6eac11140b4fc279024501242bc5f0dfc7544c3
      https://github.com/WebKit/WebKit/commit/a6eac11140b4fc279024501242bc5f0dfc7544c3
  Author: Wenson Hsieh <wenson_hsieh at apple.com>
  Date:   2023-11-19 (Sun, 19 Nov 2023)

  Changed paths:
    A LayoutTests/fast/events/key-event-with-quirks-enabled-expected.txt
    A LayoutTests/fast/events/key-event-with-quirks-enabled.html
    M Source/WebCore/bindings/js/JSLocalDOMWindowCustom.cpp
    M Source/WebCore/page/Quirks.cpp

  Log Message:
  -----------
  Occasional debug assertion under IntlNumberFormat::initializeNumberFormat when running Speedometer 3
https://bugs.webkit.org/show_bug.cgi?id=265113
rdar://118619451

Reviewed by Chris Dumez.

Grab the JSC API lock before calling into `JSObject::hasProperty()` when checking for the presence
of the `tableauPrep` property.

* LayoutTests/fast/events/key-event-with-quirks-enabled-expected.txt: Added.
* LayoutTests/fast/events/key-event-with-quirks-enabled.html: Added.
* Source/WebCore/bindings/js/JSLocalDOMWindowCustom.cpp:
(WebCore::JSLocalDOMWindow::getOwnPropertySlot):
(WebCore::JSLocalDOMWindow::getOwnPropertySlotByIndex):

Add a new debug assertion when reading properties off of the window object without having the JS API
lock; without the fix above, the assertion is hit in the new layout test, where site-specific quirks
are enabled.

* Source/WebCore/page/Quirks.cpp:
(WebCore::Quirks::needsDisableDOMPasteAccessQuirk const):

Canonical link: https://commits.webkit.org/270961@main