Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: db2338357f30d1ec38ab727fac5f4ac811279e1d
https://github.com/WebKit/WebKit/commit/db2338357f30d1ec38ab727fac5f4ac811279e1d
Author: Yijia Huang <[email protected]>
Date: 2025-03-03 (Mon, 03 Mar 2025)
Changed paths:
M Source/JavaScriptCore/bytecompiler/NodesCodegen.cpp
M Source/JavaScriptCore/runtime/StringPrototype.cpp
M Source/JavaScriptCore/runtime/WeakGCMap.h
Log Message:
-----------
REGRESSION(291398@main): ASSERTION FAILED: expected.asNumber() ==
result.asNumber() in JSC::EncodedJSValue
JSC::arrayProtoFuncIndexOf(JSGlobalObject *, CallFrame *)
https://bugs.webkit.org/show_bug.cgi?id=288931
rdar://145945591
Reviewed by Yusuke Suzuki.
We should use `HashMap::add` instead of `HashMap::set` when updating an
AtomString array because `set` replaces the old value with a new one.
This can disrupt the liveness of existing AtomStrings, which is undesirable
since we want to preserve the already allocated AtomString's pointer in the map.
By using `add`, we ensure that once an AtomString is stored, it remains
live as long as it is needed, preventing unnecessary churn in the AtomString
map.
* Source/JavaScriptCore/bytecompiler/NodesCodegen.cpp:
(JSC::ArrayNode::emitBytecode):
* Source/JavaScriptCore/runtime/StringPrototype.cpp:
(JSC::JSC_DEFINE_HOST_FUNCTION):
* Source/JavaScriptCore/runtime/WeakGCMap.h:
Canonical link: https://commits.webkit.org/291535@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes
