Changeset 233697 in webkit

Timestamp:

Jul 10, 2018, 1:47:07 PM (7 years ago)

Author:

mark.lam@apple.com

Message:

[32-bit JSC tests] ASSERTION FAILED: !butterfly->propertyStorage()[-I - 1].get() under JSC::ObjectInitializationScope::verifyPropertiesAreInitialized.
​https://bugs.webkit.org/show_bug.cgi?id=187362
<rdar://problem/42027210>

Reviewed by Saam Barati.

On 32-bit targets, a 0 valued JSValue is not the empty JSValue, but it is a valid
value to use for initializing unused properties. Updated an assertion to account
for this.

• runtime/ObjectInitializationScope.cpp:

(JSC::ObjectInitializationScope::verifyPropertiesAreInitialized):

Location:

trunk/Source/JavaScriptCore

Files:

• ChangeLog (modified) (1 diff)
• runtime/ObjectInitializationScope.cpp (modified) (1 diff)

trunk/Source/JavaScriptCore/ChangeLog ¶

@@ +1 @@
+2018-07-10  Mark Lam  <mark.lam@apple.com>
+
+        [32-bit JSC tests] ASSERTION FAILED: !butterfly->propertyStorage()[-I - 1].get() under JSC::ObjectInitializationScope::verifyPropertiesAreInitialized.
+        https://bugs.webkit.org/show_bug.cgi?id=187362
+        <rdar://problem/42027210>
+
+        Reviewed by Saam Barati.
+
+        On 32-bit targets, a 0 valued JSValue is not the empty JSValue, but it is a valid
+        value to use for initializing unused properties.  Updated an assertion to account
+        for this.
+
+        * runtime/ObjectInitializationScope.cpp:
+        (JSC::ObjectInitializationScope::verifyPropertiesAreInitialized):
+
 2018-07-10  Michael Saboff  <msaboff@apple.com>
 

trunk/Source/JavaScriptCore/runtime/ObjectInitializationScope.cpp ¶

@@ -84 +84 @@
     }
 
+    auto isSafeEmptyValueForGCScanning = [] (JSValue value) {
+#if USE(JSVALUE64)
+        return !value;
+#else
+        return !value || !JSValue::encode(value);
+#endif
+    };
+
     for (int64_t i = 0; i < static_cast<int64_t>(structure->outOfLineCapacity()); i++) {
         // We rely on properties past the last offset be zero for concurrent GC.
         if (i + firstOutOfLineOffset > structure->lastOffset())
-            ASSERT(!butterfly->propertyStorage()[-i - 1].get());
+            ASSERT(isSafeEmptyValueForGCScanning(butterfly->propertyStorage()[-i - 1].get()));
         else if (isScribbledValue(butterfly->propertyStorage()[-i - 1].get())) {
             dataLogLn("Found scribbled property at i = ", -i - 1);