Changeset 284852 in webkit

Timestamp:

Oct 25, 2021, 5:34:53 PM (5 years ago)

Author:

ysuzuki@apple.com

Message:

[JSC] Fix stale assertion in InternalFunctionAllocationProfile after r284757
​https://bugs.webkit.org/show_bug.cgi?id=232269

Reviewed by Robin Morisset.

Now, condition in InternalFunction is changed in r284757. We need to update
this assertion accordingly. It is tested (and crashing) in the existing stress test[1].

[1]: InternalFunctionAllocationProfile-createAllocationStructureFromBase-should-allow-for-same-classInfo-from-different-globals.js

• bytecode/InternalFunctionAllocationProfile.h:

(JSC::InternalFunctionAllocationProfile::createAllocationStructureFromBase):

Location:

trunk/Source/JavaScriptCore

Files:

• ChangeLog (modified) (1 diff)
• bytecode/InternalFunctionAllocationProfile.h (modified) (1 diff)

trunk/Source/JavaScriptCore/ChangeLog

@@ +1 @@
+2021-10-25  Yusuke Suzuki  <ysuzuki@apple.com>
+
+        [JSC] Fix stale assertion in InternalFunctionAllocationProfile after r284757
+        https://bugs.webkit.org/show_bug.cgi?id=232269
+
+        Reviewed by Robin Morisset.
+
+        Now, condition in InternalFunction is changed in r284757. We need to update
+        this assertion accordingly. It is tested (and crashing) in the existing stress test[1].
+
+        [1]: InternalFunctionAllocationProfile-createAllocationStructureFromBase-should-allow-for-same-classInfo-from-different-globals.js
+
+        * bytecode/InternalFunctionAllocationProfile.h:
+        (JSC::InternalFunctionAllocationProfile::createAllocationStructureFromBase):
+
 2021-10-25  Yusuke Suzuki  <ysuzuki@apple.com>
 

trunk/Source/JavaScriptCore/bytecode/InternalFunctionAllocationProfile.h

@@ -48 +48 @@
 inline Structure* InternalFunctionAllocationProfile::createAllocationStructureFromBase(VM& vm, JSGlobalObject* baseGlobalObject, JSCell* owner, JSObject* prototype, Structure* baseStructure)
 {
-    ASSERT(!m_structure || m_structure.get()->classInfo() != baseStructure->classInfo() || m_structure->globalObject() != baseGlobalObject);
+    ASSERT(!m_structure || m_structure.get()->classInfo() != baseStructure->classInfo() || m_structure->globalObject() != baseStructure->globalObject());
     ASSERT(baseStructure->hasMonoProto());