Title: [129065] trunk/Source/_javascript_Core
- Revision
- 129065
- Author
- [email protected]
- Date
- 2012-09-19 16:27:00 -0700 (Wed, 19 Sep 2012)
Log Message
REGRESSION(r128802): It made some JS tests crash
https://bugs.webkit.org/show_bug.cgi?id=97001
Reviewed by Mark Hahnenberg.
* runtime/JSGlobalObject.cpp:
(JSC::JSGlobalObject::visitChildren):
Modified Paths
Diff
Modified: trunk/Source/_javascript_Core/ChangeLog (129064 => 129065)
--- trunk/Source/_javascript_Core/ChangeLog 2012-09-19 23:25:50 UTC (rev 129064)
+++ trunk/Source/_javascript_Core/ChangeLog 2012-09-19 23:27:00 UTC (rev 129065)
@@ -1,5 +1,15 @@
2012-09-19 Filip Pizlo <[email protected]>
+ REGRESSION(r128802): It made some JS tests crash
+ https://bugs.webkit.org/show_bug.cgi?id=97001
+
+ Reviewed by Mark Hahnenberg.
+
+ * runtime/JSGlobalObject.cpp:
+ (JSC::JSGlobalObject::visitChildren):
+
+2012-09-19 Filip Pizlo <[email protected]>
+
DFG should not assume that a ByVal access is generic just because it was unprofiled
https://bugs.webkit.org/show_bug.cgi?id=97088
Modified: trunk/Source/_javascript_Core/runtime/JSGlobalObject.cpp (129064 => 129065)
--- trunk/Source/_javascript_Core/runtime/JSGlobalObject.cpp 2012-09-19 23:25:50 UTC (rev 129064)
+++ trunk/Source/_javascript_Core/runtime/JSGlobalObject.cpp 2012-09-19 23:27:00 UTC (rev 129065)
@@ -482,6 +482,7 @@
visitor.append(&thisObject->m_nameScopeStructure);
visitor.append(&thisObject->m_argumentsStructure);
visitor.append(&thisObject->m_arrayStructure);
+ visitor.append(&thisObject->m_arrayStructureForSlowPut);
visitor.append(&thisObject->m_booleanObjectStructure);
visitor.append(&thisObject->m_callbackConstructorStructure);
visitor.append(&thisObject->m_callbackFunctionStructure);
_______________________________________________
webkit-changes mailing list
[email protected]
http://lists.webkit.org/mailman/listinfo/webkit-changes
