Title: [221440] trunk/Source/_javascript_Core
- Revision
- 221440
- Author
- [email protected]
- Date
- 2017-08-31 13:50:55 -0700 (Thu, 31 Aug 2017)
Log Message
Fix debug crashes.
Rubber stamped by Mark Lam.
* runtime/JSArrayBufferView.cpp:
(JSC::JSArrayBufferView::ConstructionContext::ConstructionContext):
Modified Paths
Diff
Modified: trunk/Source/_javascript_Core/ChangeLog (221439 => 221440)
--- trunk/Source/_javascript_Core/ChangeLog 2017-08-31 20:46:58 UTC (rev 221439)
+++ trunk/Source/_javascript_Core/ChangeLog 2017-08-31 20:50:55 UTC (rev 221440)
@@ -1,5 +1,14 @@
2017-08-31 Filip Pizlo <[email protected]>
+ Fix debug crashes.
+
+ Rubber stamped by Mark Lam.
+
+ * runtime/JSArrayBufferView.cpp:
+ (JSC::JSArrayBufferView::ConstructionContext::ConstructionContext):
+
+2017-08-31 Filip Pizlo <[email protected]>
+
All of the different ArrayBuffer::data's should be CagedPtr<>
https://bugs.webkit.org/show_bug.cgi?id=175515
Modified: trunk/Source/_javascript_Core/runtime/JSArrayBufferView.cpp (221439 => 221440)
--- trunk/Source/_javascript_Core/runtime/JSArrayBufferView.cpp 2017-08-31 20:46:58 UTC (rev 221439)
+++ trunk/Source/_javascript_Core/runtime/JSArrayBufferView.cpp 2017-08-31 20:50:55 UTC (rev 221440)
@@ -77,7 +77,7 @@
m_mode = FastTypedArray;
if (mode == ZeroFill) {
- uint64_t* asWords = static_cast<uint64_t*>(m_vector.get());
+ uint64_t* asWords = static_cast<uint64_t*>(m_vector.getMayBeNull());
for (unsigned i = size / sizeof(uint64_t); i--;)
asWords[i] = 0;
}
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes
