Title: [221701] trunk/Source/_javascript_Core
- Revision
- 221701
- Author
- [email protected]
- Date
- 2017-09-06 13:51:02 -0700 (Wed, 06 Sep 2017)
Log Message
ASSERTION FAILED: op() == CheckStructure in Source/_javascript_Core/dfg/DFGNode.h(443)
https://bugs.webkit.org/show_bug.cgi?id=176470
Reviewed by Mark Lam.
Update Node::convertToCheckStructureImmediate's assertion to allow
the node to either be a CheckStructure or CheckStructureOrEmpty.
* dfg/DFGNode.h:
(JSC::DFG::Node::convertToCheckStructureImmediate):
Modified Paths
Diff
Modified: trunk/Source/_javascript_Core/ChangeLog (221700 => 221701)
--- trunk/Source/_javascript_Core/ChangeLog 2017-09-06 20:48:01 UTC (rev 221700)
+++ trunk/Source/_javascript_Core/ChangeLog 2017-09-06 20:51:02 UTC (rev 221701)
@@ -1,3 +1,16 @@
+2017-09-06 Saam Barati <[email protected]>
+
+ ASSERTION FAILED: op() == CheckStructure in Source/_javascript_Core/dfg/DFGNode.h(443)
+ https://bugs.webkit.org/show_bug.cgi?id=176470
+
+ Reviewed by Mark Lam.
+
+ Update Node::convertToCheckStructureImmediate's assertion to allow
+ the node to either be a CheckStructure or CheckStructureOrEmpty.
+
+ * dfg/DFGNode.h:
+ (JSC::DFG::Node::convertToCheckStructureImmediate):
+
2017-09-05 Saam Barati <[email protected]>
isNotCellSpeculation is wrong with respect to SpecEmpty
Modified: trunk/Source/_javascript_Core/dfg/DFGNode.h (221700 => 221701)
--- trunk/Source/_javascript_Core/dfg/DFGNode.h 2017-09-06 20:48:01 UTC (rev 221700)
+++ trunk/Source/_javascript_Core/dfg/DFGNode.h 2017-09-06 20:51:02 UTC (rev 221701)
@@ -440,7 +440,7 @@
void convertToCheckStructureImmediate(Node* structure)
{
- ASSERT(op() == CheckStructure);
+ ASSERT(op() == CheckStructure || op() == CheckStructureOrEmpty);
m_op = CheckStructureImmediate;
children.setChild1(Edge(structure, CellUse));
}
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes
