Title: [96564] trunk/Source/_javascript_Core
- Revision
- 96564
- Author
- [email protected]
- Date
- 2011-10-03 18:37:19 -0700 (Mon, 03 Oct 2011)
Log Message
JSC ASSERT Opening the Web Inspector
https://bugs.webkit.org/show_bug.cgi?id=69293
Reviewed by Oliver Hunt.
If a polymorphic access structure list has a duplicated structure, then
don't crash.
* dfg/DFGByteCodeParser.cpp:
(JSC::DFG::ByteCodeParser::parseBlock):
Modified Paths
Diff
Modified: trunk/Source/_javascript_Core/ChangeLog (96563 => 96564)
--- trunk/Source/_javascript_Core/ChangeLog 2011-10-04 01:16:46 UTC (rev 96563)
+++ trunk/Source/_javascript_Core/ChangeLog 2011-10-04 01:37:19 UTC (rev 96564)
@@ -1,3 +1,16 @@
+2011-10-03 Filip Pizlo <[email protected]>
+
+ JSC ASSERT Opening the Web Inspector
+ https://bugs.webkit.org/show_bug.cgi?id=69293
+
+ Reviewed by Oliver Hunt.
+
+ If a polymorphic access structure list has a duplicated structure, then
+ don't crash.
+
+ * dfg/DFGByteCodeParser.cpp:
+ (JSC::DFG::ByteCodeParser::parseBlock):
+
2011-10-03 Gavin Barraclough <[email protected]>
On X86, switch bucketCount into a register, timeoutCheck into memory
Modified: trunk/Source/_javascript_Core/dfg/DFGByteCodeParser.cpp (96563 => 96564)
--- trunk/Source/_javascript_Core/dfg/DFGByteCodeParser.cpp 2011-10-04 01:16:46 UTC (rev 96563)
+++ trunk/Source/_javascript_Core/dfg/DFGByteCodeParser.cpp 2011-10-04 01:37:19 UTC (rev 96564)
@@ -1191,6 +1191,9 @@
}
Structure* structure = list->list[i].base.get();
+ if (structureSet.contains(structure))
+ continue;
+
size_t myOffset = structure->get(*m_globalData, identifier);
if (myOffset == notFound) {
_______________________________________________
webkit-changes mailing list
[email protected]
http://lists.webkit.org/mailman/listinfo.cgi/webkit-changes
