Changeset 176506 in webkit

Timestamp:

Nov 22, 2014, 11:07:26 AM (12 years ago)

Author:

msaboff@apple.com

Message:

r176455: ASSERT(!m_vector.isEmpty()) in IntendedStructureChain.cpp(143)
​https://bugs.webkit.org/show_bug.cgi?id=139000

Reviewed by Darin Adler.

Check that the chainCount is non-zero before using a StructureChain.

• bytecode/ComplexGetStatus.cpp:

(JSC::ComplexGetStatus::computeFor):

Location:

trunk/Source/JavaScriptCore

Files:

• ChangeLog (modified) (1 diff)
• bytecode/ComplexGetStatus.cpp (modified) (1 diff)

trunk/Source/JavaScriptCore/ChangeLog

@@ +1 @@
+2014-11-21  Michael Saboff  <msaboff@apple.com>
+
+        r176455: ASSERT(!m_vector.isEmpty()) in IntendedStructureChain.cpp(143)
+        https://bugs.webkit.org/show_bug.cgi?id=139000
+
+        Reviewed by Darin Adler.
+
+        Check that the chainCount is non-zero before using a StructureChain.
+
+        * bytecode/ComplexGetStatus.cpp:
+        (JSC::ComplexGetStatus::computeFor):
+
 2014-11-21  Michael Saboff  <msaboff@apple.com>
 

trunk/Source/JavaScriptCore/bytecode/ComplexGetStatus.cpp

@@ -47 +47 @@
     result.m_kind = Inlineable;
     
-    if (chain) {
+    if (chain && chainCount) {
         result.m_chain = adoptRef(new IntendedStructureChain(
             profiledBlock, headStructure, chain, chainCount));