Title: [154407] trunk
- Revision
- 154407
- Author
- [email protected]
- Date
- 2013-08-21 13:31:02 -0700 (Wed, 21 Aug 2013)
Log Message
Remove incorrect ASSERT from CopyVisitor::visitItem
Rubber stamped by Filip Pizlo.
Source/_javascript_Core:
* heap/CopyVisitorInlines.h:
(JSC::CopyVisitor::visitItem):
LayoutTests:
Added a new test that triggered the old ASSERT. It's a useful test to have because we create
TypedArrays with custom properties.
* fast/js/regress/ArrayBuffer-Int8Array-alloc-large-long-lived-fragmented-expected.txt: Added.
* fast/js/regress/ArrayBuffer-Int8Array-alloc-large-long-lived-fragmented.html: Added.
* fast/js/regress/script-tests/ArrayBuffer-Int8Array-alloc-large-long-lived-fragmented.js: Added.
Modified Paths
Added Paths
Diff
Modified: trunk/LayoutTests/ChangeLog (154406 => 154407)
--- trunk/LayoutTests/ChangeLog 2013-08-21 20:30:40 UTC (rev 154406)
+++ trunk/LayoutTests/ChangeLog 2013-08-21 20:31:02 UTC (rev 154407)
@@ -1,3 +1,16 @@
+2013-08-21 Mark Hahnenberg <[email protected]>
+
+ Remove incorrect ASSERT from CopyVisitor::visitItem
+
+ Rubber stamped by Filip Pizlo.
+
+ Added a new test that triggered the old ASSERT. It's a useful test to have because we create
+ TypedArrays with custom properties.
+
+ * fast/js/regress/ArrayBuffer-Int8Array-alloc-large-long-lived-fragmented-expected.txt: Added.
+ * fast/js/regress/ArrayBuffer-Int8Array-alloc-large-long-lived-fragmented.html: Added.
+ * fast/js/regress/script-tests/ArrayBuffer-Int8Array-alloc-large-long-lived-fragmented.js: Added.
+
2013-08-21 Tim Horton <[email protected]>
REGRESSION(r154399): broke Mac ML debug WK1 tests > 50 crashes (Requested by thorton on #webkit).
Added: trunk/LayoutTests/fast/js/regress/ArrayBuffer-Int8Array-alloc-large-long-lived-fragmented-expected.txt (0 => 154407)
--- trunk/LayoutTests/fast/js/regress/ArrayBuffer-Int8Array-alloc-large-long-lived-fragmented-expected.txt (rev 0)
+++ trunk/LayoutTests/fast/js/regress/ArrayBuffer-Int8Array-alloc-large-long-lived-fragmented-expected.txt 2013-08-21 20:31:02 UTC (rev 154407)
@@ -0,0 +1,10 @@
+JSRegress/ArrayBuffer-Int8Array-alloc-large-long-lived-fragmented
+
+On success, you will see a series of "PASS" messages, followed by "TEST COMPLETE".
+
+
+PASS no exception thrown
+PASS successfullyParsed is true
+
+TEST COMPLETE
+
Added: trunk/LayoutTests/fast/js/regress/ArrayBuffer-Int8Array-alloc-large-long-lived-fragmented.html (0 => 154407)
--- trunk/LayoutTests/fast/js/regress/ArrayBuffer-Int8Array-alloc-large-long-lived-fragmented.html (rev 0)
+++ trunk/LayoutTests/fast/js/regress/ArrayBuffer-Int8Array-alloc-large-long-lived-fragmented.html 2013-08-21 20:31:02 UTC (rev 154407)
@@ -0,0 +1,12 @@
+<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML//EN">
+<html>
+<head>
+<script src=""
+</head>
+<body>
+<script src=""
+<script src=""
+<script src=""
+<script src=""
+</body>
+</html>
Added: trunk/LayoutTests/fast/js/regress/script-tests/ArrayBuffer-Int8Array-alloc-large-long-lived-fragmented.js (0 => 154407)
--- trunk/LayoutTests/fast/js/regress/script-tests/ArrayBuffer-Int8Array-alloc-large-long-lived-fragmented.js (rev 0)
+++ trunk/LayoutTests/fast/js/regress/script-tests/ArrayBuffer-Int8Array-alloc-large-long-lived-fragmented.js 2013-08-21 20:31:02 UTC (rev 154407)
@@ -0,0 +1,19 @@
+var array = new Array(10000);
+
+var fragmentedArray = [];
+
+for (var i = 0; i < 100000; ++i) {
+ var newArray = new Int8Array(new ArrayBuffer(1000));
+ if (i % 10 === 0)
+ newArray.customProperty = "foo";
+ for (var j = 0; j < 10; j++)
+ fragmentedArray = new Array(10);
+ array[i % array.length] = newArray;
+}
+
+for (var i = 0; i < array.length; ++i) {
+ if (array[i].length != 1000)
+ throw "Error: bad length: " + array[i].length;
+ if (array[i].buffer.byteLength != 1000)
+ throw "Error: bad buffer.byteLength: " + array[i].buffer.byteLength;
+}
Modified: trunk/Source/_javascript_Core/ChangeLog (154406 => 154407)
--- trunk/Source/_javascript_Core/ChangeLog 2013-08-21 20:30:40 UTC (rev 154406)
+++ trunk/Source/_javascript_Core/ChangeLog 2013-08-21 20:31:02 UTC (rev 154407)
@@ -1,3 +1,12 @@
+2013-08-21 Mark Hahnenberg <[email protected]>
+
+ Remove incorrect ASSERT from CopyVisitor::visitItem
+
+ Rubber stamped by Filip Pizlo.
+
+ * heap/CopyVisitorInlines.h:
+ (JSC::CopyVisitor::visitItem):
+
2013-08-21 Gavin Barraclough <[email protected]>
https://bugs.webkit.org/show_bug.cgi?id=120127
Modified: trunk/Source/_javascript_Core/heap/CopyVisitorInlines.h (154406 => 154407)
--- trunk/Source/_javascript_Core/heap/CopyVisitorInlines.h 2013-08-21 20:30:40 UTC (rev 154406)
+++ trunk/Source/_javascript_Core/heap/CopyVisitorInlines.h 2013-08-21 20:31:02 UTC (rev 154407)
@@ -37,7 +37,6 @@
inline void CopyVisitor::visitItem(CopyWorklistItem item)
{
if (item.token() == ButterflyCopyToken) {
- ASSERT(item.cell()->structure()->classInfo()->methodTable.copyBackingStore == JSObject::copyBackingStore);
JSObject::copyBackingStore(item.cell(), *this, ButterflyCopyToken);
return;
}
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes
