Title: [284852] trunk/Source/_javascript_Core
- Revision
- 284852
- Author
- [email protected]
- Date
- 2021-10-25 17:34:53 -0700 (Mon, 25 Oct 2021)
Log Message
[JSC] Fix stale assertion in InternalFunctionAllocationProfile after r284757
https://bugs.webkit.org/show_bug.cgi?id=232269
Reviewed by Robin Morisset.
Now, condition in InternalFunction is changed in r284757. We need to update
this assertion accordingly. It is tested (and crashing) in the existing stress test[1].
[1]: InternalFunctionAllocationProfile-createAllocationStructureFromBase-should-allow-for-same-classInfo-from-different-globals.js
* bytecode/InternalFunctionAllocationProfile.h:
(JSC::InternalFunctionAllocationProfile::createAllocationStructureFromBase):
Modified Paths
Diff
Modified: trunk/Source/_javascript_Core/ChangeLog (284851 => 284852)
--- trunk/Source/_javascript_Core/ChangeLog 2021-10-26 00:17:53 UTC (rev 284851)
+++ trunk/Source/_javascript_Core/ChangeLog 2021-10-26 00:34:53 UTC (rev 284852)
@@ -1,5 +1,20 @@
2021-10-25 Yusuke Suzuki <[email protected]>
+ [JSC] Fix stale assertion in InternalFunctionAllocationProfile after r284757
+ https://bugs.webkit.org/show_bug.cgi?id=232269
+
+ Reviewed by Robin Morisset.
+
+ Now, condition in InternalFunction is changed in r284757. We need to update
+ this assertion accordingly. It is tested (and crashing) in the existing stress test[1].
+
+ [1]: InternalFunctionAllocationProfile-createAllocationStructureFromBase-should-allow-for-same-classInfo-from-different-globals.js
+
+ * bytecode/InternalFunctionAllocationProfile.h:
+ (JSC::InternalFunctionAllocationProfile::createAllocationStructureFromBase):
+
+2021-10-25 Yusuke Suzuki <[email protected]>
+
[JSC] Don't branch around register allocation in DFG enumerator get by val
https://bugs.webkit.org/show_bug.cgi?id=232260
rdar://84544469
Modified: trunk/Source/_javascript_Core/bytecode/InternalFunctionAllocationProfile.h (284851 => 284852)
--- trunk/Source/_javascript_Core/bytecode/InternalFunctionAllocationProfile.h 2021-10-26 00:17:53 UTC (rev 284851)
+++ trunk/Source/_javascript_Core/bytecode/InternalFunctionAllocationProfile.h 2021-10-26 00:34:53 UTC (rev 284852)
@@ -47,7 +47,7 @@
inline Structure* InternalFunctionAllocationProfile::createAllocationStructureFromBase(VM& vm, JSGlobalObject* baseGlobalObject, JSCell* owner, JSObject* prototype, Structure* baseStructure)
{
- ASSERT(!m_structure || m_structure.get()->classInfo() != baseStructure->classInfo() || m_structure->globalObject() != baseGlobalObject);
+ ASSERT(!m_structure || m_structure.get()->classInfo() != baseStructure->classInfo() || m_structure->globalObject() != baseStructure->globalObject());
ASSERT(baseStructure->hasMonoProto());
Structure* structure;
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes
