Title: [290530] trunk/Source/_javascript_Core
- Revision
- 290530
- Author
- [email protected]
- Date
- 2022-02-25 15:19:46 -0800 (Fri, 25 Feb 2022)
Log Message
Remove incorrect ASSERT.
https://bugs.webkit.org/show_bug.cgi?id=237185
<rdar://problem/83902782>
Reviewed by Yusuke Suzuki.
These debug ASSERTs were added in http://trac.webkit.org/r283632 back when we
weren't sure that the StringImpl pointer can be null or not. We're now certain
that the StringImpl pointer can be null because:
The site of the ASSERT looks like this:
```
auto* impl = string->tryGetValueImpl();
ASSERT(impl); // FIXME: rdar://83902782
if (impl && impl->isAtom() &&
...
```
... where string is a JSString, which can also be a JSRopeString.
JSString::tryGetValueImpl() is:
```
inline const StringImpl* JSString::tryGetValueImpl() const
{
uintptr_t pointer = fiberConcurrently();
if (pointer & isRopeInPointer)
return nullptr;
return bitwise_cast<StringImpl*>(pointer);
}
```
If string is a JSRopeString, the returned impl will be null. Hence, the ASSERT is
invalid and should be removed.
* dfg/DFGByteCodeParser.cpp:
(JSC::DFG::ByteCodeParser::parseBlock):
(JSC::DFG::ByteCodeParser::handlePutByVal):
Modified Paths
Diff
Modified: trunk/Source/_javascript_Core/ChangeLog (290529 => 290530)
--- trunk/Source/_javascript_Core/ChangeLog 2022-02-25 22:24:44 UTC (rev 290529)
+++ trunk/Source/_javascript_Core/ChangeLog 2022-02-25 23:19:46 UTC (rev 290530)
@@ -1,3 +1,42 @@
+2022-02-24 Mark Lam <[email protected]>
+
+ Remove incorrect ASSERT.
+ https://bugs.webkit.org/show_bug.cgi?id=237185
+ <rdar://problem/83902782>
+
+ Reviewed by Yusuke Suzuki.
+
+ These debug ASSERTs were added in http://trac.webkit.org/r283632 back when we
+ weren't sure that the StringImpl pointer can be null or not. We're now certain
+ that the StringImpl pointer can be null because:
+
+ The site of the ASSERT looks like this:
+ ```
+ auto* impl = string->tryGetValueImpl();
+ ASSERT(impl); // FIXME: rdar://83902782
+ if (impl && impl->isAtom() &&
+ ...
+ ```
+ ... where string is a JSString, which can also be a JSRopeString.
+
+ JSString::tryGetValueImpl() is:
+ ```
+ inline const StringImpl* JSString::tryGetValueImpl() const
+ {
+ uintptr_t pointer = fiberConcurrently();
+ if (pointer & isRopeInPointer)
+ return nullptr;
+ return bitwise_cast<StringImpl*>(pointer);
+ }
+ ```
+
+ If string is a JSRopeString, the returned impl will be null. Hence, the ASSERT is
+ invalid and should be removed.
+
+ * dfg/DFGByteCodeParser.cpp:
+ (JSC::DFG::ByteCodeParser::parseBlock):
+ (JSC::DFG::ByteCodeParser::handlePutByVal):
+
2022-02-25 Commit Queue <[email protected]>
Unreviewed, reverting r290516.
Modified: trunk/Source/_javascript_Core/dfg/DFGByteCodeParser.cpp (290529 => 290530)
--- trunk/Source/_javascript_Core/dfg/DFGByteCodeParser.cpp 2022-02-25 22:24:44 UTC (rev 290529)
+++ trunk/Source/_javascript_Core/dfg/DFGByteCodeParser.cpp 2022-02-25 23:19:46 UTC (rev 290530)
@@ -6502,7 +6502,6 @@
addToGraph(CheckIsConstant, OpInfo(frozen), property);
} else if (auto* string = property->dynamicCastConstant<JSString*>(*m_vm)) {
auto* impl = string->tryGetValueImpl();
- ASSERT(impl); // FIXME: rdar://83902782
if (impl && impl->isAtom() && !parseIndex(*const_cast<StringImpl*>(impl))) {
uid = bitwise_cast<UniquedStringImpl*>(impl);
propertyCell = string;
@@ -8899,7 +8898,6 @@
addToGraph(CheckIsConstant, OpInfo(frozen), property);
} else if (auto* string = property->dynamicCastConstant<JSString*>(*m_vm)) {
auto* impl = string->tryGetValueImpl();
- ASSERT(impl); // FIXME: rdar://83902782
if (impl && impl->isAtom() && !parseIndex(*const_cast<StringImpl*>(impl))) {
uid = bitwise_cast<UniquedStringImpl*>(impl);
propertyCell = string;
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes
