Title: [195398] trunk/Source/_javascript_Core
- Revision
- 195398
- Author
- [email protected]
- Date
- 2016-01-20 20:47:23 -0800 (Wed, 20 Jan 2016)
Log Message
Unreviewed, rolling out r195375.
https://bugs.webkit.org/show_bug.cgi?id=153300
Caused crashes on GuardMalloc (Requested by ap on #webkit).
Reverted changeset:
"TypedArray's .buffer does not return the JSArrayBuffer that
was passed to it on creation."
https://bugs.webkit.org/show_bug.cgi?id=153281
http://trac.webkit.org/changeset/195375
Modified Paths
Removed Paths
Diff
Modified: trunk/Source/_javascript_Core/ChangeLog (195397 => 195398)
--- trunk/Source/_javascript_Core/ChangeLog 2016-01-21 03:50:45 UTC (rev 195397)
+++ trunk/Source/_javascript_Core/ChangeLog 2016-01-21 04:47:23 UTC (rev 195398)
@@ -1,3 +1,17 @@
+2016-01-20 Commit Queue <[email protected]>
+
+ Unreviewed, rolling out r195375.
+ https://bugs.webkit.org/show_bug.cgi?id=153300
+
+ Caused crashes on GuardMalloc (Requested by ap on #webkit).
+
+ Reverted changeset:
+
+ "TypedArray's .buffer does not return the JSArrayBuffer that
+ was passed to it on creation."
+ https://bugs.webkit.org/show_bug.cgi?id=153281
+ http://trac.webkit.org/changeset/195375
+
2016-01-19 Filip Pizlo <[email protected]>
B3 should have basic path specialization
Modified: trunk/Source/_javascript_Core/runtime/JSArrayBuffer.cpp (195397 => 195398)
--- trunk/Source/_javascript_Core/runtime/JSArrayBuffer.cpp 2016-01-21 03:50:45 UTC (rev 195397)
+++ trunk/Source/_javascript_Core/runtime/JSArrayBuffer.cpp 2016-01-21 04:47:23 UTC (rev 195398)
@@ -44,7 +44,6 @@
{
Base::finishCreation(vm);
vm.heap.addReference(this, m_impl);
- m_impl->m_wrapper = this;
}
JSArrayBuffer* JSArrayBuffer::create(
Deleted: trunk/Source/_javascript_Core/tests/stress/typedarray-buffer-neutered.js (195397 => 195398)
--- trunk/Source/_javascript_Core/tests/stress/typedarray-buffer-neutered.js 2016-01-21 03:50:45 UTC (rev 195397)
+++ trunk/Source/_javascript_Core/tests/stress/typedarray-buffer-neutered.js 2016-01-21 04:47:23 UTC (rev 195398)
@@ -1,13 +0,0 @@
-typedArrays = [Int8Array, Uint8Array, Uint8ClampedArray, Int16Array, Uint16Array, Int32Array, Uint32Array, Float32Array, Float64Array];
-
-buffer = new ArrayBuffer(16);
-transferArrayBuffer(buffer);
-
-arrays = typedArrays.map(function(constructor) { return new constructor(buffer); });
-
-for (i = 0; i < 100000; i++) {
- arrays.forEach(function(array) {
- if (array.buffer !== buffer)
- throw "wrong buffer";
- });
-}
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes
