Title: [151976] branches/safari-537-branch/Source/WebCore
- Revision
- 151976
- Author
- [email protected]
- Date
- 2013-06-25 18:09:26 -0700 (Tue, 25 Jun 2013)
Log Message
Merged r151747. <rdar://problem/14187667>
Modified Paths
Diff
Modified: branches/safari-537-branch/Source/WebCore/ChangeLog (151975 => 151976)
--- branches/safari-537-branch/Source/WebCore/ChangeLog 2013-06-26 01:06:00 UTC (rev 151975)
+++ branches/safari-537-branch/Source/WebCore/ChangeLog 2013-06-26 01:09:26 UTC (rev 151976)
@@ -1,5 +1,23 @@
2013-06-25 Lucas Forschler <[email protected]>
+ Merge r151747
+
+ 2013-06-19 Oliver Hunt <[email protected]>
+
+ Incorrect use of jsCast in a finalizer
+ https://bugs.webkit.org/show_bug.cgi?id=117807
+
+ Reviewed by Geoffrey Garen.
+
+ We can't use jsCast in a finalizer as it checks an object's structure,
+ and the structure may already have been swept by that point. Use a
+ static_cast instead.
+
+ * bridge/runtime_array.cpp:
+ (JSC::RuntimeArray::destroy):
+
+2013-06-25 Lucas Forschler <[email protected]>
+
Merge r151929
2013-06-24 Ruth Fong <[email protected]>
Modified: branches/safari-537-branch/Source/WebCore/bridge/runtime_array.cpp (151975 => 151976)
--- branches/safari-537-branch/Source/WebCore/bridge/runtime_array.cpp 2013-06-26 01:06:00 UTC (rev 151975)
+++ branches/safari-537-branch/Source/WebCore/bridge/runtime_array.cpp 2013-06-26 01:09:26 UTC (rev 151976)
@@ -57,7 +57,7 @@
void RuntimeArray::destroy(JSCell* cell)
{
- jsCast<RuntimeArray*>(cell)->RuntimeArray::~RuntimeArray();
+ static_cast<RuntimeArray*>(cell)->RuntimeArray::~RuntimeArray();
}
JSValue RuntimeArray::lengthGetter(ExecState*, JSValue slotBase, PropertyName)
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes
