Changeset 250172 in webkit

Timestamp:

Sep 20, 2019 5:29:13 PM (5 years ago)

Author:

mark.lam@apple.com

Message:

Harden assertion in StructureIDTable::get().
​https://bugs.webkit.org/show_bug.cgi?id=202067
<rdar://problem/55577923>

Reviewed by Keith Miller.

• runtime/StructureIDTable.h:

(JSC::StructureIDTable::get):

Location:

trunk/Source/JavaScriptCore

Files:

• ChangeLog (modified) (1 diff)
• runtime/StructureIDTable.h (modified) (1 diff)

trunk/Source/JavaScriptCore/ChangeLog

@@ +1 @@
+2019-09-20  Mark Lam  <mark.lam@apple.com>
+
+        Harden assertion in StructureIDTable::get().
+        https://bugs.webkit.org/show_bug.cgi?id=202067
+        <rdar://problem/55577923>
+
+        Reviewed by Keith Miller.
+
+        * runtime/StructureIDTable.h:
+        (JSC::StructureIDTable::get):
+
 2019-09-20  Truitt Savell  <tsavell@apple.com>
 

trunk/Source/JavaScriptCore/runtime/StructureIDTable.h

@@ -173 +173 @@
     ASSERT_WITH_SECURITY_IMPLICATION(!isNuked(structureID));
     uint32_t structureIndex = structureID >> s_numberOfEntropyBits;
-    ASSERT_WITH_SECURITY_IMPLICATION(structureIndex < m_capacity);
+    RELEASE_ASSERT_WITH_SECURITY_IMPLICATION(structureIndex < m_capacity);
     return decode(table()[structureIndex].encodedStructureBits, structureID);
 }