Title: [205746] trunk/Source/_javascript_Core
- Revision
- 205746
- Author
- [email protected]
- Date
- 2016-09-09 09:50:10 -0700 (Fri, 09 Sep 2016)
Log Message
HashMapImpl needs to m_buffer.clear() in its constructor
https://bugs.webkit.org/show_bug.cgi?id=161796
Reviewed by Keith Miller.
This is the second time that I'm fixing a bug because AuxiliaryBarrier does not initialize
itself. That seemed like a good idea because maybe sometimes the user knows better how to
initialize it. But, it's not worth it if it's a constant source of bugs.
So, I'm fixing it for good by making AuxiliaryBarrier::AuxiliaryBarrier() initialize its
m_value.
* runtime/AuxiliaryBarrier.h:
(JSC::AuxiliaryBarrier::AuxiliaryBarrier):
* runtime/DirectArguments.cpp:
(JSC::DirectArguments::DirectArguments):
Modified Paths
Diff
Modified: trunk/Source/_javascript_Core/ChangeLog (205745 => 205746)
--- trunk/Source/_javascript_Core/ChangeLog 2016-09-09 16:29:02 UTC (rev 205745)
+++ trunk/Source/_javascript_Core/ChangeLog 2016-09-09 16:50:10 UTC (rev 205746)
@@ -1,3 +1,22 @@
+2016-09-09 Filip Pizlo <[email protected]>
+
+ HashMapImpl needs to m_buffer.clear() in its constructor
+ https://bugs.webkit.org/show_bug.cgi?id=161796
+
+ Reviewed by Keith Miller.
+
+ This is the second time that I'm fixing a bug because AuxiliaryBarrier does not initialize
+ itself. That seemed like a good idea because maybe sometimes the user knows better how to
+ initialize it. But, it's not worth it if it's a constant source of bugs.
+
+ So, I'm fixing it for good by making AuxiliaryBarrier::AuxiliaryBarrier() initialize its
+ m_value.
+
+ * runtime/AuxiliaryBarrier.h:
+ (JSC::AuxiliaryBarrier::AuxiliaryBarrier):
+ * runtime/DirectArguments.cpp:
+ (JSC::DirectArguments::DirectArguments):
+
2016-09-09 Youenn Fablet <[email protected]>
ASSERTION FAILED: promise.inherits(JSPromise::info())
Modified: trunk/Source/_javascript_Core/runtime/AuxiliaryBarrier.h (205745 => 205746)
--- trunk/Source/_javascript_Core/runtime/AuxiliaryBarrier.h 2016-09-09 16:29:02 UTC (rev 205745)
+++ trunk/Source/_javascript_Core/runtime/AuxiliaryBarrier.h 2016-09-09 16:50:10 UTC (rev 205746)
@@ -37,8 +37,7 @@
template<typename T>
class AuxiliaryBarrier {
public:
- // This doesn't initialize m_value because I worry about performance on PLT, or something.
- AuxiliaryBarrier() { }
+ AuxiliaryBarrier(): m_value() { }
template<typename U>
AuxiliaryBarrier(VM&, JSCell*, U&&);
Modified: trunk/Source/_javascript_Core/runtime/DirectArguments.cpp (205745 => 205746)
--- trunk/Source/_javascript_Core/runtime/DirectArguments.cpp 2016-09-09 16:29:02 UTC (rev 205745)
+++ trunk/Source/_javascript_Core/runtime/DirectArguments.cpp 2016-09-09 16:50:10 UTC (rev 205746)
@@ -41,8 +41,6 @@
, m_length(length)
, m_minCapacity(capacity)
{
- m_overrides.clear();
-
// When we construct the object from C++ code, we expect the capacity to be at least as large as
// length. JIT-allocated DirectArguments objects play evil tricks, though.
ASSERT(capacity >= length);
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes
