Changeset 140619 in webkit

Timestamp:

Jan 23, 2013 5:40:37 PM (11 years ago)

Author:

oliver@apple.com

Message:

Harden JSC a bit with RELEASE_ASSERT
​https://bugs.webkit.org/show_bug.cgi?id=107766

Reviewed by Mark Hahnenberg.

Went through and replaced a pile of ASSERTs that were covering
significantly important details (bounds checks, etc) where
having the checks did not impact release performance in any
measurable way.

• API/JSContextRef.cpp:

(JSContextCreateBacktrace):

• assembler/MacroAssembler.h:

(JSC::MacroAssembler::branchAdd32):
(JSC::MacroAssembler::branchMul32):

• bytecode/CodeBlock.cpp:

(JSC::CodeBlock::dumpBytecode):
(JSC::CodeBlock::handlerForBytecodeOffset):
(JSC::CodeBlock::lineNumberForBytecodeOffset):
(JSC::CodeBlock::bytecodeOffset):

• bytecode/CodeBlock.h:

(JSC::CodeBlock::bytecodeOffsetForCallAtIndex):
(JSC::CodeBlock::bytecodeOffset):
(JSC::CodeBlock::exceptionHandler):
(JSC::CodeBlock::codeOrigin):
(JSC::CodeBlock::immediateSwitchJumpTable):
(JSC::CodeBlock::characterSwitchJumpTable):
(JSC::CodeBlock::stringSwitchJumpTable):
(JSC::CodeBlock::setIdentifiers):
(JSC::baselineCodeBlockForInlineCallFrame):
(JSC::ExecState::uncheckedR):

• bytecode/CodeOrigin.cpp:

(JSC::CodeOrigin::inlineStack):

• bytecode/CodeOrigin.h:

(JSC::CodeOrigin::CodeOrigin):

• dfg/DFGCSEPhase.cpp:
• dfg/DFGOSRExit.cpp:
• dfg/DFGScratchRegisterAllocator.h:

(JSC::DFG::ScratchRegisterAllocator::preserveUsedRegistersToScratchBuffer):
(JSC::DFG::ScratchRegisterAllocator::restoreUsedRegistersFromScratchBuffer):

• dfg/DFGSpeculativeJIT.h:

(JSC::DFG::SpeculativeJIT::allocate):
(JSC::DFG::SpeculativeJIT::spill):
(JSC::DFG::SpeculativeJIT::integerResult):

• dfg/DFGSpeculativeJIT64.cpp:

(JSC::DFG::SpeculativeJIT::fillInteger):
(JSC::DFG::SpeculativeJIT::fillDouble):
(JSC::DFG::SpeculativeJIT::fillJSValue):
(JSC::DFG::SpeculativeJIT::nonSpeculativeCompareNull):
(JSC::DFG::SpeculativeJIT::emitCall):
(JSC::DFG::SpeculativeJIT::fillSpeculateIntInternal):
(JSC::DFG::SpeculativeJIT::fillSpeculateIntStrict):
(JSC::DFG::SpeculativeJIT::fillSpeculateDouble):
(JSC::DFG::SpeculativeJIT::fillSpeculateCell):
(JSC::DFG::SpeculativeJIT::fillSpeculateBoolean):
(JSC::DFG::SpeculativeJIT::compile):

• dfg/DFGValueSource.h:

(JSC::DFG::dataFormatToValueSourceKind):
(JSC::DFG::ValueSource::ValueSource):

• dfg/DFGVirtualRegisterAllocationPhase.cpp:
• heap/BlockAllocator.cpp:

(JSC::BlockAllocator::BlockAllocator):
(JSC::BlockAllocator::releaseFreeRegions):
(JSC::BlockAllocator::blockFreeingThreadMain):

• heap/Heap.cpp:

(JSC::Heap::lastChanceToFinalize):
(JSC::Heap::collect):

• interpreter/Interpreter.cpp:

(JSC::Interpreter::throwException):
(JSC::Interpreter::execute):

• jit/GCAwareJITStubRoutine.cpp:

(JSC::GCAwareJITStubRoutine::observeZeroRefCount):

• jit/JIT.cpp:

(JSC::JIT::privateCompileMainPass):
(JSC::JIT::privateCompileSlowCases):

• jit/JITExceptions.cpp:

(JSC::genericThrow):

• jit/JITInlines.h:

(JSC::JIT::emitLoad):

• jit/JITOpcodes.cpp:

(JSC::JIT::emit_op_end):
(JSC::JIT::emit_resolve_operations):

• jit/JITStubRoutine.cpp:

(JSC::JITStubRoutine::observeZeroRefCount):

• jit/JITStubs.cpp:

(JSC::returnToThrowTrampoline):

• runtime/Arguments.cpp:

(JSC::Arguments::getOwnPropertySlot):
(JSC::Arguments::getOwnPropertyDescriptor):
(JSC::Arguments::deleteProperty):
(JSC::Arguments::defineOwnProperty):
(JSC::Arguments::didTearOffActivation):

• runtime/ArrayPrototype.cpp:

(JSC::shift):
(JSC::unshift):
(JSC::arrayProtoFuncLastIndexOf):

• runtime/ButterflyInlines.h:

(JSC::Butterfly::growPropertyStorage):

• runtime/CodeCache.cpp:

(JSC::CodeCache::getFunctionExecutableFromGlobalCode):

• runtime/CodeCache.h:

(JSC::CacheMap::add):

• runtime/Completion.cpp:

(JSC::checkSyntax):
(JSC::evaluate):

• runtime/Executable.cpp:

(JSC::FunctionExecutable::FunctionExecutable):
(JSC::EvalExecutable::unlinkCalls):
(JSC::ProgramExecutable::compileOptimized):
(JSC::ProgramExecutable::unlinkCalls):
(JSC::ProgramExecutable::initializeGlobalProperties):
(JSC::FunctionExecutable::baselineCodeBlockFor):
(JSC::FunctionExecutable::compileOptimizedForCall):
(JSC::FunctionExecutable::compileOptimizedForConstruct):
(JSC::FunctionExecutable::compileForCallInternal):
(JSC::FunctionExecutable::compileForConstructInternal):
(JSC::FunctionExecutable::unlinkCalls):
(JSC::NativeExecutable::hashFor):

• runtime/Executable.h:

(JSC::EvalExecutable::compile):
(JSC::ProgramExecutable::compile):
(JSC::FunctionExecutable::compileForCall):
(JSC::FunctionExecutable::compileForConstruct):

• runtime/IndexingHeader.h:

(JSC::IndexingHeader::setVectorLength):

• runtime/JSArray.cpp:

(JSC::JSArray::pop):
(JSC::JSArray::shiftCountWithArrayStorage):
(JSC::JSArray::shiftCountWithAnyIndexingType):
(JSC::JSArray::unshiftCountWithArrayStorage):

• runtime/JSGlobalObjectFunctions.cpp:

(JSC::jsStrDecimalLiteral):

• runtime/JSObject.cpp:

(JSC::JSObject::copyButterfly):
(JSC::JSObject::defineOwnIndexedProperty):
(JSC::JSObject::putByIndexBeyondVectorLengthWithoutAttributes):

• runtime/JSString.cpp:

(JSC::JSRopeString::getIndexSlowCase):

• yarr/YarrInterpreter.cpp:

(JSC::Yarr::Interpreter::popParenthesesDisjunctionContext):

Location:

trunk/Source/JavaScriptCore

Files:

• API/JSContextRef.cpp (modified) (1 diff)
• ChangeLog (modified) (1 diff)
• assembler/MacroAssembler.h (modified) (2 diffs)
• bytecode/CodeBlock.cpp (modified) (5 diffs)
• bytecode/CodeBlock.h (modified) (8 diffs)
• bytecode/CodeOrigin.cpp (modified) (1 diff)
• bytecode/CodeOrigin.h (modified) (1 diff)
• dfg/DFGCSEPhase.cpp (modified) (1 diff)
• dfg/DFGOSRExit.cpp (modified) (1 diff)
• dfg/DFGScratchRegisterAllocator.h (modified) (3 diffs)
• dfg/DFGSpeculativeJIT.h (modified) (5 diffs)
• dfg/DFGSpeculativeJIT64.cpp (modified) (16 diffs)
• dfg/DFGValueSource.h (modified) (2 diffs)
• dfg/DFGVirtualRegisterAllocationPhase.cpp (modified) (1 diff)
• heap/BlockAllocator.cpp (modified) (3 diffs)
• heap/Heap.cpp (modified) (2 diffs)
• interpreter/Interpreter.cpp (modified) (3 diffs)
• jit/GCAwareJITStubRoutine.cpp (modified) (1 diff)
• jit/JIT.cpp (modified) (5 diffs)
• jit/JITExceptions.cpp (modified) (2 diffs)
• jit/JITInlines.h (modified) (1 diff)
• jit/JITOpcodes.cpp (modified) (6 diffs)
• jit/JITStubRoutine.cpp (modified) (1 diff)
• jit/JITStubs.cpp (modified) (1 diff)
• runtime/Arguments.cpp (modified) (5 diffs)
• runtime/ArrayPrototype.cpp (modified) (3 diffs)
• runtime/ButterflyInlines.h (modified) (1 diff)
• runtime/CodeCache.cpp (modified) (1 diff)
• runtime/CodeCache.h (modified) (1 diff)
• runtime/Completion.cpp (modified) (2 diffs)
• runtime/Executable.cpp (modified) (13 diffs)
• runtime/Executable.h (modified) (4 diffs)
• runtime/IndexingHeader.h (modified) (1 diff)
• runtime/JSArray.cpp (modified) (8 diffs)
• runtime/JSGlobalObjectFunctions.cpp (modified) (1 diff)
• runtime/JSObject.cpp (modified) (3 diffs)
• runtime/JSString.cpp (modified) (1 diff)
• yarr/YarrInterpreter.cpp (modified) (1 diff)

trunk/Source/JavaScriptCore/API/JSContextRef.cpp

@@ -182 +182 @@
     }
     while (true) {
-        ASSERT(callFrame);
+        RELEASE_ASSERT(callFrame);
         int signedLineNumber;
         intptr_t sourceID;

trunk/Source/JavaScriptCore/ChangeLog

@@ +1 @@
+2013-01-23  Oliver Hunt  <oliver@apple.com>
+
+        Harden JSC a bit with RELEASE_ASSERT
+        https://bugs.webkit.org/show_bug.cgi?id=107766
+
+        Reviewed by Mark Hahnenberg.
+
+        Went through and replaced a pile of ASSERTs that were covering
+        significantly important details (bounds checks, etc) where
+        having the checks did not impact release performance in any
+        measurable way.
+
+        * API/JSContextRef.cpp:
+        (JSContextCreateBacktrace):
+        * assembler/MacroAssembler.h:
+        (JSC::MacroAssembler::branchAdd32):
+        (JSC::MacroAssembler::branchMul32):
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::dumpBytecode):
+        (JSC::CodeBlock::handlerForBytecodeOffset):
+        (JSC::CodeBlock::lineNumberForBytecodeOffset):
+        (JSC::CodeBlock::bytecodeOffset):
+        * bytecode/CodeBlock.h:
+        (JSC::CodeBlock::bytecodeOffsetForCallAtIndex):
+        (JSC::CodeBlock::bytecodeOffset):
+        (JSC::CodeBlock::exceptionHandler):
+        (JSC::CodeBlock::codeOrigin):
+        (JSC::CodeBlock::immediateSwitchJumpTable):
+        (JSC::CodeBlock::characterSwitchJumpTable):
+        (JSC::CodeBlock::stringSwitchJumpTable):
+        (JSC::CodeBlock::setIdentifiers):
+        (JSC::baselineCodeBlockForInlineCallFrame):
+        (JSC::ExecState::uncheckedR):
+        * bytecode/CodeOrigin.cpp:
+        (JSC::CodeOrigin::inlineStack):
+        * bytecode/CodeOrigin.h:
+        (JSC::CodeOrigin::CodeOrigin):
+        * dfg/DFGCSEPhase.cpp:
+        * dfg/DFGOSRExit.cpp:
+        * dfg/DFGScratchRegisterAllocator.h:
+        (JSC::DFG::ScratchRegisterAllocator::preserveUsedRegistersToScratchBuffer):
+        (JSC::DFG::ScratchRegisterAllocator::restoreUsedRegistersFromScratchBuffer):
+        * dfg/DFGSpeculativeJIT.h:
+        (JSC::DFG::SpeculativeJIT::allocate):
+        (JSC::DFG::SpeculativeJIT::spill):
+        (JSC::DFG::SpeculativeJIT::integerResult):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::fillInteger):
+        (JSC::DFG::SpeculativeJIT::fillDouble):
+        (JSC::DFG::SpeculativeJIT::fillJSValue):
+        (JSC::DFG::SpeculativeJIT::nonSpeculativeCompareNull):
+        (JSC::DFG::SpeculativeJIT::emitCall):
+        (JSC::DFG::SpeculativeJIT::fillSpeculateIntInternal):
+        (JSC::DFG::SpeculativeJIT::fillSpeculateIntStrict):
+        (JSC::DFG::SpeculativeJIT::fillSpeculateDouble):
+        (JSC::DFG::SpeculativeJIT::fillSpeculateCell):
+        (JSC::DFG::SpeculativeJIT::fillSpeculateBoolean):
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGValueSource.h:
+        (JSC::DFG::dataFormatToValueSourceKind):
+        (JSC::DFG::ValueSource::ValueSource):
+        * dfg/DFGVirtualRegisterAllocationPhase.cpp:
+        * heap/BlockAllocator.cpp:
+        (JSC::BlockAllocator::BlockAllocator):
+        (JSC::BlockAllocator::releaseFreeRegions):
+        (JSC::BlockAllocator::blockFreeingThreadMain):
+        * heap/Heap.cpp:
+        (JSC::Heap::lastChanceToFinalize):
+        (JSC::Heap::collect):
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::throwException):
+        (JSC::Interpreter::execute):
+        * jit/GCAwareJITStubRoutine.cpp:
+        (JSC::GCAwareJITStubRoutine::observeZeroRefCount):
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompileMainPass):
+        (JSC::JIT::privateCompileSlowCases):
+        * jit/JITExceptions.cpp:
+        (JSC::genericThrow):
+        * jit/JITInlines.h:
+        (JSC::JIT::emitLoad):
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_end):
+        (JSC::JIT::emit_resolve_operations):
+        * jit/JITStubRoutine.cpp:
+        (JSC::JITStubRoutine::observeZeroRefCount):
+        * jit/JITStubs.cpp:
+        (JSC::returnToThrowTrampoline):
+        * runtime/Arguments.cpp:
+        (JSC::Arguments::getOwnPropertySlot):
+        (JSC::Arguments::getOwnPropertyDescriptor):
+        (JSC::Arguments::deleteProperty):
+        (JSC::Arguments::defineOwnProperty):
+        (JSC::Arguments::didTearOffActivation):
+        * runtime/ArrayPrototype.cpp:
+        (JSC::shift):
+        (JSC::unshift):
+        (JSC::arrayProtoFuncLastIndexOf):
+        * runtime/ButterflyInlines.h:
+        (JSC::Butterfly::growPropertyStorage):
+        * runtime/CodeCache.cpp:
+        (JSC::CodeCache::getFunctionExecutableFromGlobalCode):
+        * runtime/CodeCache.h:
+        (JSC::CacheMap::add):
+        * runtime/Completion.cpp:
+        (JSC::checkSyntax):
+        (JSC::evaluate):
+        * runtime/Executable.cpp:
+        (JSC::FunctionExecutable::FunctionExecutable):
+        (JSC::EvalExecutable::unlinkCalls):
+        (JSC::ProgramExecutable::compileOptimized):
+        (JSC::ProgramExecutable::unlinkCalls):
+        (JSC::ProgramExecutable::initializeGlobalProperties):
+        (JSC::FunctionExecutable::baselineCodeBlockFor):
+        (JSC::FunctionExecutable::compileOptimizedForCall):
+        (JSC::FunctionExecutable::compileOptimizedForConstruct):
+        (JSC::FunctionExecutable::compileForCallInternal):
+        (JSC::FunctionExecutable::compileForConstructInternal):
+        (JSC::FunctionExecutable::unlinkCalls):
+        (JSC::NativeExecutable::hashFor):
+        * runtime/Executable.h:
+        (JSC::EvalExecutable::compile):
+        (JSC::ProgramExecutable::compile):
+        (JSC::FunctionExecutable::compileForCall):
+        (JSC::FunctionExecutable::compileForConstruct):
+        * runtime/IndexingHeader.h:
+        (JSC::IndexingHeader::setVectorLength):
+        * runtime/JSArray.cpp:
+        (JSC::JSArray::pop):
+        (JSC::JSArray::shiftCountWithArrayStorage):
+        (JSC::JSArray::shiftCountWithAnyIndexingType):
+        (JSC::JSArray::unshiftCountWithArrayStorage):
+        * runtime/JSGlobalObjectFunctions.cpp:
+        (JSC::jsStrDecimalLiteral):
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::copyButterfly):
+        (JSC::JSObject::defineOwnIndexedProperty):
+        (JSC::JSObject::putByIndexBeyondVectorLengthWithoutAttributes):
+        * runtime/JSString.cpp:
+        (JSC::JSRopeString::getIndexSlowCase):
+        * yarr/YarrInterpreter.cpp:
+        (JSC::Yarr::Interpreter::popParenthesesDisjunctionContext):
+
 2013-01-23  Filip Pizlo  <fpizlo@apple.com>
 

trunk/Source/JavaScriptCore/assembler/MacroAssembler.h

@@ -1352 +1352 @@
     {
         if (src == dest)
-            RELEASE_ASSERT(scratchRegisterForBlinding());
+            ASSERT(scratchRegisterForBlinding());
 
         if (shouldBlind(imm)) {
@@ -1370 +1370 @@
     {
         if (src == dest)
-            RELEASE_ASSERT(scratchRegisterForBlinding());
+            ASSERT(scratchRegisterForBlinding());
 
         if (shouldBlind(imm)) {

trunk/Source/JavaScriptCore/bytecode/CodeBlock.cpp

@@ -1495 +1495 @@
 #if ENABLE(LLINT_C_LOOP)
         default:
-            ASSERT(false); // We should never get here.
+            RELEASE_ASSERT_NOT_REACHED();
 #endif
     }
@@ -2493 +2493 @@
 HandlerInfo* CodeBlock::handlerForBytecodeOffset(unsigned bytecodeOffset)
 {
-    ASSERT(bytecodeOffset < instructions().size());
+    RELEASE_ASSERT(bytecodeOffset < instructions().size());
 
     if (!m_rareData)
@@ -2511 +2511 @@
 int CodeBlock::lineNumberForBytecodeOffset(unsigned bytecodeOffset)
 {
-    ASSERT(bytecodeOffset < instructions().size());
+    RELEASE_ASSERT(bytecodeOffset < instructions().size());
     return m_ownerExecutable->lineNo() + m_unlinkedCode->lineNumberForBytecodeOffset(bytecodeOffset);
 }
@@ -2731 +2731 @@
 #endif
     {
-        ASSERT(exec->codeBlock());
-        ASSERT(exec->codeBlock() == this);
-        ASSERT(JITCode::isBaselineCode(getJITType()));
+        RELEASE_ASSERT(exec->codeBlock());
+        RELEASE_ASSERT(exec->codeBlock() == this);
+        RELEASE_ASSERT(JITCode::isBaselineCode(getJITType()));
         Instruction* instruction = exec->currentVPC();
-        ASSERT(instruction);
+        RELEASE_ASSERT(instruction);
 
         instruction = adjustPCIfAtCallSite(instruction);
@@ -2754 +2754 @@
             binarySearch<CallReturnOffsetToBytecodeOffset, unsigned>(
                 callIndices, callIndices.size(), callReturnOffset, getCallReturnOffset);
-        ASSERT(result->callReturnOffset == callReturnOffset);
+        RELEASE_ASSERT(result->callReturnOffset == callReturnOffset);
         return result->bytecodeOffset;
     }

trunk/Source/JavaScriptCore/bytecode/CodeBlock.h

@@ -279 +279 @@
             if (!callIndices.size())
                 return 1;
-            ASSERT(index < m_rareData->m_callReturnIndexVector.size());
+            RELEASE_ASSERT(index < m_rareData->m_callReturnIndexVector.size());
             return m_rareData->m_callReturnIndexVector[index].bytecodeOffset;
         }
@@ -458 +458 @@
         unsigned bytecodeOffset(Instruction* returnAddress)
         {
-            ASSERT(returnAddress >= instructions().begin() && returnAddress < instructions().end());
+            RELEASE_ASSERT(returnAddress >= instructions().begin() && returnAddress < instructions().end());
             return static_cast<Instruction*>(returnAddress) - instructions().begin();
         }
@@ -815 +815 @@
 
         }
-        HandlerInfo& exceptionHandler(int index) { ASSERT(m_rareData); return m_rareData->m_exceptionHandlers[index]; }
+        HandlerInfo& exceptionHandler(int index) { RELEASE_ASSERT(m_rareData); return m_rareData->m_exceptionHandlers[index]; }
 
         bool hasExpressionInfo() { return m_unlinkedCode->hasExpressionInfo(); }
@@ -850 +850 @@
         CodeOrigin codeOrigin(unsigned index)
         {
-            ASSERT(m_rareData);
+            RELEASE_ASSERT(m_rareData);
             return m_rareData->m_codeOrigins[index].codeOrigin;
         }
@@ -941 +941 @@
         size_t numberOfImmediateSwitchJumpTables() const { return m_rareData ? m_rareData->m_immediateSwitchJumpTables.size() : 0; }
         SimpleJumpTable& addImmediateSwitchJumpTable() { createRareDataIfNecessary(); m_rareData->m_immediateSwitchJumpTables.append(SimpleJumpTable()); return m_rareData->m_immediateSwitchJumpTables.last(); }
-        SimpleJumpTable& immediateSwitchJumpTable(int tableIndex) { ASSERT(m_rareData); return m_rareData->m_immediateSwitchJumpTables[tableIndex]; }
+        SimpleJumpTable& immediateSwitchJumpTable(int tableIndex) { RELEASE_ASSERT(m_rareData); return m_rareData->m_immediateSwitchJumpTables[tableIndex]; }
 
         size_t numberOfCharacterSwitchJumpTables() const { return m_rareData ? m_rareData->m_characterSwitchJumpTables.size() : 0; }
         SimpleJumpTable& addCharacterSwitchJumpTable() { createRareDataIfNecessary(); m_rareData->m_characterSwitchJumpTables.append(SimpleJumpTable()); return m_rareData->m_characterSwitchJumpTables.last(); }
-        SimpleJumpTable& characterSwitchJumpTable(int tableIndex) { ASSERT(m_rareData); return m_rareData->m_characterSwitchJumpTables[tableIndex]; }
+        SimpleJumpTable& characterSwitchJumpTable(int tableIndex) { RELEASE_ASSERT(m_rareData); return m_rareData->m_characterSwitchJumpTables[tableIndex]; }
 
         size_t numberOfStringSwitchJumpTables() const { return m_rareData ? m_rareData->m_stringSwitchJumpTables.size() : 0; }
         StringJumpTable& addStringSwitchJumpTable() { createRareDataIfNecessary(); m_rareData->m_stringSwitchJumpTables.append(StringJumpTable()); return m_rareData->m_stringSwitchJumpTables.last(); }
-        StringJumpTable& stringSwitchJumpTable(int tableIndex) { ASSERT(m_rareData); return m_rareData->m_stringSwitchJumpTables[tableIndex]; }
+        StringJumpTable& stringSwitchJumpTable(int tableIndex) { RELEASE_ASSERT(m_rareData); return m_rareData->m_stringSwitchJumpTables[tableIndex]; }
 
 
@@ -1159 +1159 @@
         void setIdentifiers(const Vector<Identifier>& identifiers)
         {
-            ASSERT(m_identifiers.isEmpty());
+            RELEASE_ASSERT(m_identifiers.isEmpty());
             m_identifiers.appendVector(identifiers);
         }
@@ -1460 +1460 @@
     inline CodeBlock* baselineCodeBlockForInlineCallFrame(InlineCallFrame* inlineCallFrame)
     {
-        ASSERT(inlineCallFrame);
+        RELEASE_ASSERT(inlineCallFrame);
         ExecutableBase* executable = inlineCallFrame->executable.get();
-        ASSERT(executable->structure()->classInfo() == &FunctionExecutable::s_info);
+        RELEASE_ASSERT(executable->structure()->classInfo() == &FunctionExecutable::s_info);
         return static_cast<FunctionExecutable*>(executable)->baselineCodeBlockFor(inlineCallFrame->isCall ? CodeForCall : CodeForConstruct);
     }
@@ -1496 +1496 @@
     inline Register& ExecState::uncheckedR(int index)
     {
-        ASSERT(index < FirstConstantRegisterIndex);
+        RELEASE_ASSERT(index < FirstConstantRegisterIndex);
         return this[index];
     }

trunk/Source/JavaScriptCore/bytecode/CodeOrigin.cpp

@@ -54 +54 @@
     for (InlineCallFrame* current = inlineCallFrame; current; current = current->caller.inlineCallFrame)
         result[index--] = current->caller;
-    ASSERT(!result[0].inlineCallFrame);
+    RELEASE_ASSERT(!result[0].inlineCallFrame);
     return result;
 }

trunk/Source/JavaScriptCore/bytecode/CodeOrigin.h

@@ -66 +66 @@
         , inlineCallFrame(inlineCallFrame)
     {
-        ASSERT(bytecodeIndex <= maximumBytecodeIndex);
-        ASSERT(valueProfileOffset < (1u << 3));
+        RELEASE_ASSERT(bytecodeIndex <= maximumBytecodeIndex);
+        RELEASE_ASSERT(valueProfileOffset < (1u << 3));
     }
     

trunk/Source/JavaScriptCore/dfg/DFGCSEPhase.cpp

@@ -31 +31 @@
 #include "DFGGraph.h"
 #include "DFGPhase.h"
+#include "JSCellInlines.h"
 #include <wtf/FastBitVector.h>
 

trunk/Source/JavaScriptCore/dfg/DFGOSRExit.cpp

@@ -31 +31 @@
 #include "DFGAssemblyHelpers.h"
 #include "DFGSpeculativeJIT.h"
+#include "JSCellInlines.h"
 
 namespace JSC { namespace DFG {

trunk/Source/JavaScriptCore/dfg/DFGScratchRegisterAllocator.h

@@ -138 +138 @@
                 scratchGPR = GPRInfo::toRegister(i);
         }
-        ASSERT(scratchGPR != InvalidGPRReg);
+        RELEASE_ASSERT(scratchGPR != InvalidGPRReg);
         for (unsigned i = FPRInfo::numberOfRegisters; i--;) {
             if (m_usedRegisters.getFPRByIndex(i)) {
@@ -145 +145 @@
             }
         }
-        ASSERT(count * sizeof(JSValue) == desiredScratchBufferSize());
+        RELEASE_ASSERT(count * sizeof(JSValue) == desiredScratchBufferSize());
         
         jit.move(MacroAssembler::TrustedImmPtr(&scratchBuffer->m_activeLength), scratchGPR);
@@ -162 +162 @@
             }
         }
-        ASSERT(scratchGPR != InvalidGPRReg);
+        RELEASE_ASSERT(scratchGPR != InvalidGPRReg);
         
         jit.move(MacroAssembler::TrustedImmPtr(&scratchBuffer->m_activeLength), scratchGPR);

trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.h

@@ -190 +190 @@
 #if USE(JSVALUE32_64)
             GenerationInfo& info = m_generationInfo[spillMe];
-            ASSERT(info.registerFormat() != DataFormatJSDouble);
+            RELEASE_ASSERT(info.registerFormat() != DataFormatJSDouble);
             if ((info.registerFormat() & DataFormatJS))
                 m_gprs.release(info.tagGPR() == gpr ? info.payloadGPR() : info.tagGPR());
@@ -204 +204 @@
 #if USE(JSVALUE32_64)
             GenerationInfo& info = m_generationInfo[spillMe];
-            ASSERT(info.registerFormat() != DataFormatJSDouble);
+            RELEASE_ASSERT(info.registerFormat() != DataFormatJSDouble);
             if ((info.registerFormat() & DataFormatJS))
                 m_gprs.release(info.tagGPR() == specific ? info.payloadGPR() : info.tagGPR());
@@ -498 +498 @@
         default:
             // The following code handles JSValues, int32s, and cells.
-            ASSERT(spillFormat == DataFormatCell || spillFormat & DataFormatJS);
+            RELEASE_ASSERT(spillFormat == DataFormatCell || spillFormat & DataFormatJS);
             
             GPRReg reg = info.gpr();
@@ -528 +528 @@
         default:
             // The following code handles JSValues.
-            ASSERT(spillFormat & DataFormatJS);
+            RELEASE_ASSERT(spillFormat & DataFormatJS);
             m_jit.store32(info.tagGPR(), JITCompiler::tagFor(spillMe));
             m_jit.store32(info.payloadGPR(), JITCompiler::payloadFor(spillMe));
@@ -800 +800 @@
         } else {
 #if USE(JSVALUE64)
-            ASSERT(format == DataFormatJSInteger);
+            RELEASE_ASSERT(format == DataFormatJSInteger);
             m_jit.jitAssertIsJSInt32(reg);
             m_gprs.retain(reg, virtualRegister, SpillOrderJS);

trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT64.cpp

@@ -71 +71 @@
             m_jit.or64(GPRInfo::tagTypeNumberRegister, gpr);
         } else {
-            ASSERT(info.spillFormat() == DataFormatJS || info.spillFormat() == DataFormatJSInteger);
+            RELEASE_ASSERT(info.spillFormat() == DataFormatJS || info.spillFormat() == DataFormatJSInteger);
             m_gprs.retain(gpr, virtualRegister, SpillOrderSpilled);
             m_jit.load64(JITCompiler::addressFor(virtualRegister), gpr);
@@ -177 +177 @@
                 GPRReg gpr = allocate();
         
-                ASSERT(spillFormat & DataFormatJS);
+                RELEASE_ASSERT(spillFormat & DataFormatJS);
                 m_gprs.retain(gpr, virtualRegister, SpillOrderSpilled);
                 m_jit.load64(JITCompiler::addressFor(virtualRegister), gpr);
@@ -310 +310 @@
                     spillFormat = DataFormatJSDouble;
                 } else
-                    ASSERT(spillFormat & DataFormatJS);
+                    RELEASE_ASSERT(spillFormat & DataFormatJS);
             }
             info.fillJSValue(*m_stream, gpr, spillFormat);
@@ -693 +693 @@
         NodeIndex branchNodeIndex = m_jit.graph().m_blocks[m_block]->at(branchIndexInBlock);
 
-        ASSERT(node.adjustedRefCount() == 1);
+        RELEASE_ASSERT(node.adjustedRefCount() == 1);
         
         nonSpeculativePeepholeBranchNull(operand, branchNodeIndex, invert);
@@ -993 +993 @@
 {
     if (node.op() != Call)
-        ASSERT(node.op() == Construct);
+        RELEASE_ASSERT(node.op() == Construct);
 
     // For constructors, the this argument is not passed but we have to make space
@@ -1095 +1095 @@
         DataFormat spillFormat = info.spillFormat();
         
-        ASSERT((spillFormat & DataFormatJS) || spillFormat == DataFormatInteger);
+        RELEASE_ASSERT((spillFormat & DataFormatJS) || spillFormat == DataFormatInteger);
         
         m_gprs.retain(gpr, virtualRegister, SpillOrderSpilled);
@@ -1208 +1208 @@
     DataFormat mustBeDataFormatInteger;
     GPRReg result = fillSpeculateIntInternal<true>(nodeIndex, mustBeDataFormatInteger, BackwardSpeculation);
-    ASSERT(mustBeDataFormatInteger == DataFormatInteger);
+    RELEASE_ASSERT(mustBeDataFormatInteger == DataFormatInteger);
     return result;
 }
@@ -1273 +1273 @@
             GPRReg gpr = allocate();
 
-            ASSERT(spillFormat & DataFormatJS);
+            RELEASE_ASSERT(spillFormat & DataFormatJS);
             m_gprs.retain(gpr, virtualRegister, SpillOrderSpilled);
             m_jit.load64(JITCompiler::addressFor(virtualRegister), gpr);
@@ -1396 +1396 @@
             return gpr;
         }
-        ASSERT(info.spillFormat() & DataFormatJS);
+        RELEASE_ASSERT(info.spillFormat() & DataFormatJS);
         m_gprs.retain(gpr, virtualRegister, SpillOrderSpilled);
         m_jit.load64(JITCompiler::addressFor(virtualRegister), gpr);
@@ -1472 +1472 @@
             return gpr;
         }
-        ASSERT(info.spillFormat() & DataFormatJS);
+        RELEASE_ASSERT(info.spillFormat() & DataFormatJS);
         m_gprs.retain(gpr, virtualRegister, SpillOrderSpilled);
         m_jit.load64(JITCompiler::addressFor(virtualRegister), gpr);
@@ -2806 +2806 @@
             break;
         case Array::Generic: {
-            ASSERT(node.op() == PutByVal);
+            RELEASE_ASSERT(node.op() == PutByVal);
             
             JSValueOperand arg1(this, child1);
@@ -3464 +3464 @@
             
             Structure* structure = globalObject->arrayStructureForIndexingTypeDuringAllocation(node.indexingType());
-            ASSERT(structure->indexingType() == node.indexingType());
+            RELEASE_ASSERT(structure->indexingType() == node.indexingType());
             ASSERT(
                 hasUndecided(structure->indexingType())
@@ -3770 +3770 @@
             emitAllocateJSArray(globalObject->arrayStructureForIndexingTypeDuringAllocation(indexingType), resultGPR, storageGPR, numElements);
             
-            ASSERT(indexingType & IsArray);
+            RELEASE_ASSERT(indexingType & IsArray);
             JSValue* data = m_jit.codeBlock()->constantBuffer(node.startConstant());
             if (indexingType == ArrayWithDouble) {
@@ -4656 +4656 @@
         
     case CreateActivation: {
-        ASSERT(!node.codeOrigin.inlineCallFrame);
+        RELEASE_ASSERT(!node.codeOrigin.inlineCallFrame);
         
         JSValueOperand value(this, node.child1());
@@ -4701 +4701 @@
 
     case TearOffActivation: {
-        ASSERT(!node.codeOrigin.inlineCallFrame);
+        RELEASE_ASSERT(!node.codeOrigin.inlineCallFrame);
 
         JSValueOperand activationValue(this, node.child1());
@@ -4768 +4768 @@
         }
         
-        ASSERT(!node.codeOrigin.inlineCallFrame);
+        RELEASE_ASSERT(!node.codeOrigin.inlineCallFrame);
         m_jit.load32(JITCompiler::payloadFor(JSStack::ArgumentCount), resultGPR);
         m_jit.sub32(TrustedImm32(1), resultGPR);

trunk/Source/JavaScriptCore/dfg/DFGValueSource.h

@@ -66 +66 @@
         return ArgumentsSource;
     default:
-        ASSERT(dataFormat & DataFormatJS);
+        RELEASE_ASSERT(dataFormat & DataFormatJS);
         return ValueInJSStack;
     }
@@ -123 +123 @@
         : m_nodeIndex(nodeIndex)
     {
-        ASSERT(nodeIndex != NoNode);
+        RELEASE_ASSERT(nodeIndex != NoNode);
         ASSERT(kind() == HaveNode);
     }

trunk/Source/JavaScriptCore/dfg/DFGVirtualRegisterAllocationPhase.cpp

@@ -31 +31 @@
 #include "DFGGraph.h"
 #include "DFGScoreBoard.h"
+#include "JSCellInlines.h"
 
 namespace JSC { namespace DFG {

trunk/Source/JavaScriptCore/heap/BlockAllocator.cpp

@@ -45 +45 @@
     , m_blockFreeingThread(createThread(blockFreeingThreadStartFunc, this, "JavaScriptCore::BlockFree"))
 {
-    ASSERT(m_blockFreeingThread);
+    RELEASE_ASSERT(m_blockFreeingThread);
     m_regionLock.Init();
 }
@@ -70 +70 @@
             else {
                 region = m_emptyRegions.removeHead();
-                ASSERT(region);
+                RELEASE_ASSERT(region);
                 m_numberOfEmptyRegions--;
             }
@@ -142 +142 @@
                 else {
                     region = m_emptyRegions.removeHead();
-                    ASSERT(region);
+                    RELEASE_ASSERT(region);
                     m_numberOfEmptyRegions--;
                 }

trunk/Source/JavaScriptCore/heap/Heap.cpp

@@ -281 +281 @@
 void Heap::lastChanceToFinalize()
 {
-    ASSERT(!m_globalData->dynamicGlobalObject);
-    ASSERT(m_operationInProgress == NoOperation);
+    RELEASE_ASSERT(!m_globalData->dynamicGlobalObject);
+    RELEASE_ASSERT(m_operationInProgress == NoOperation);
 
     m_objectSpace.lastChanceToFinalize();
@@ -719 +719 @@
     GCPHASE(Collect);
     ASSERT(globalData()->apiLock().currentThreadIsHoldingLock());
-    ASSERT(globalData()->identifierTable == wtfThreadData().currentIdentifierTable());
+    RELEASE_ASSERT(globalData()->identifierTable == wtfThreadData().currentIdentifierTable());
     ASSERT(m_isSafeToCollect);
     JAVASCRIPTCORE_GC_BEGIN();

trunk/Source/JavaScriptCore/interpreter/Interpreter.cpp

@@ -791 +791 @@
         int targetDepth = handler->scopeDepth;
         scopeDelta = currentDepth - targetDepth;
-        ASSERT(scopeDelta >= 0);
+        RELEASE_ASSERT(scopeDelta >= 0);
     }
     while (scopeDelta--)
@@ -836 +836 @@
     ASSERT(isValidThisObject(thisObj, callFrame));
     ASSERT(!globalData.exception);
-    RELEASE_ASSERT(!globalData.isCollectorBusy());
+    ASSERT(!globalData.isCollectorBusy());
+    if (globalData.isCollectorBusy())
+        return jsNull();
 
     StackStats::CheckPoint stackCheckPoint;
@@ -1265 +1267 @@
     JSObject* variableObject;
     for (JSScope* node = scope; ; node = node->next()) {
-        ASSERT(node);
+        RELEASE_ASSERT(node);
         if (node->isVariableObject() && !node->isNameScopeObject()) {
             variableObject = node;

trunk/Source/JavaScriptCore/jit/GCAwareJITStubRoutine.cpp

@@ -61 +61 @@
     }
     
-    ASSERT(!m_refCount);
+    RELEASE_ASSERT(!m_refCount);
 
     m_isJettisoned = true;

trunk/Source/JavaScriptCore/jit/JIT.cpp

@@ -409 +409 @@
     }
 
-    ASSERT(m_callLinkInfoIndex == m_callStructureStubCompilationInfo.size());
+    RELEASE_ASSERT(m_callLinkInfoIndex == m_callStructureStubCompilationInfo.size());
 
 #ifndef NDEBUG
@@ -434 +434 @@
     m_callLinkInfoIndex = 0;
     
-#if !ASSERT_DISABLED && ENABLE(VALUE_PROFILER)
+#if ENABLE(VALUE_PROFILER)
     // Use this to assert that slow-path code associates new profiling sites with existing
     // ValueProfiles rather than creating new ones. This ensures that for a given instruction
@@ -450 +450 @@
 
         m_bytecodeOffset = iter->to;
-#ifndef NDEBUG
+
         unsigned firstTo = m_bytecodeOffset;
-#endif
+
         Instruction* currentInstruction = instructionsBegin + m_bytecodeOffset;
         
@@ -555 +555 @@
         }
 
-        ASSERT_WITH_MESSAGE(iter == m_slowCases.end() || firstTo != iter->to,"Not enough jumps linked in slow case codegen.");
-        ASSERT_WITH_MESSAGE(firstTo == (iter - 1)->to, "Too many jumps linked in slow case codegen.");
+        RELEASE_ASSERT_WITH_MESSAGE(iter == m_slowCases.end() || firstTo != iter->to, "Not enough jumps linked in slow case codegen.");
+        RELEASE_ASSERT_WITH_MESSAGE(firstTo == (iter - 1)->to, "Too many jumps linked in slow case codegen.");
         
 #if ENABLE(VALUE_PROFILER)
@@ -566 +566 @@
     }
 
-    ASSERT(m_propertyAccessInstructionIndex == m_propertyAccessCompilationInfo.size());
-    ASSERT(m_callLinkInfoIndex == m_callStructureStubCompilationInfo.size());
+    RELEASE_ASSERT(m_propertyAccessInstructionIndex == m_propertyAccessCompilationInfo.size());
+    RELEASE_ASSERT(m_callLinkInfoIndex == m_callStructureStubCompilationInfo.size());
 #if ENABLE(VALUE_PROFILER)
-    ASSERT(numberOfValueProfiles == m_codeBlock->numberOfValueProfiles());
+    RELEASE_ASSERT(numberOfValueProfiles == m_codeBlock->numberOfValueProfiles());
 #endif
 

trunk/Source/JavaScriptCore/jit/JITExceptions.cpp

@@ -40 +40 @@
 ExceptionHandler genericThrow(JSGlobalData* globalData, ExecState* callFrame, JSValue exceptionValue, unsigned vPCIndex)
 {
-    ASSERT(exceptionValue);
+    RELEASE_ASSERT(exceptionValue);
     
     globalData->exception = JSValue();
@@ -58 +58 @@
     globalData->targetInterpreterPCForThrow = catchPCForInterpreter;
     
-    ASSERT(catchRoutine);
+    RELEASE_ASSERT(catchRoutine);
     ExceptionHandler exceptionHandler = { catchRoutine, callFrame };
     return exceptionHandler;

trunk/Source/JavaScriptCore/jit/JITInlines.h

@@ -510 +510 @@
 inline void JIT::emitLoad(int index, RegisterID tag, RegisterID payload, RegisterID base)
 {
-    ASSERT(tag != payload);
+    RELEASE_ASSERT(tag != payload);
 
     if (base == callFrameRegister) {
-        ASSERT(payload != base);
+        RELEASE_ASSERT(payload != base);
         emitLoadPayload(index, payload);
         emitLoadTag(index, tag);

trunk/Source/JavaScriptCore/jit/JITOpcodes.cpp

@@ -82 +82 @@
 void JIT::emit_op_end(Instruction* currentInstruction)
 {
-    ASSERT(returnValueRegister != callFrameRegister);
+    RELEASE_ASSERT(returnValueRegister != callFrameRegister);
     emitGetVirtualRegister(currentInstruction[1].u.operand, returnValueRegister);
     restoreReturnAddressBeforeReturn(Address(callFrameRegister, JSStack::ReturnPC * static_cast<int>(sizeof(Register))));
@@ -1307 +1307 @@
             return;
         case ResolveOperation::SetBaseToGlobal:
-            ASSERT(baseVR);
+            RELEASE_ASSERT(baseVR);
             setBase = true;
             move(TrustedImmPtr(globalObject), scratch);
@@ -1315 +1315 @@
             break;
         case ResolveOperation::SetBaseToUndefined: {
-            ASSERT(baseVR);
+            RELEASE_ASSERT(baseVR);
             setBase = true;
 #if USE(JSVALUE64)
@@ -1328 +1328 @@
         }
         case ResolveOperation::SetBaseToScope:
-            ASSERT(baseVR);
+            RELEASE_ASSERT(baseVR);
             setBase = true;
             emitStoreCell(*baseVR, scope);
@@ -1336 +1336 @@
         case ResolveOperation::ReturnScopeAsBase:
             emitStoreCell(*baseVR, scope);
-            ASSERT(value == regT0);
+            RELEASE_ASSERT(value == regT0);
             move(scope, value);
 #if USE(JSVALUE32_64)
@@ -1386 +1386 @@
         emitStoreCell(*baseVR, scope);
 
-    ASSERT(valueVR);
+    RELEASE_ASSERT(valueVR);
     ResolveOperation* resolveValueOperation = pc;
     switch (resolveValueOperation->m_operation) {

trunk/Source/JavaScriptCore/jit/JITStubRoutine.cpp

@@ -39 +39 @@
 void JITStubRoutine::observeZeroRefCount()
 {
-    ASSERT(!m_refCount);
+    RELEASE_ASSERT(!m_refCount);
     delete this;
 }

trunk/Source/JavaScriptCore/jit/JITStubs.cpp

@@ -1037 +1037 @@
 static NEVER_INLINE void returnToThrowTrampoline(JSGlobalData* globalData, ReturnAddressPtr exceptionLocation, ReturnAddressPtr& returnAddressSlot)
 {
-    ASSERT(globalData->exception);
+    RELEASE_ASSERT(globalData->exception);
     globalData->exceptionLocation = exceptionLocation;
     returnAddressSlot = ReturnAddressPtr(FunctionPtr(ctiVMThrowTrampoline));

trunk/Source/JavaScriptCore/runtime/Arguments.cpp

@@ -128 +128 @@
     unsigned i = propertyName.asIndex();
     if (JSValue value = thisObject->tryGetArgument(i)) {
-        ASSERT(i < PropertyName::NotAnIndex);
+        RELEASE_ASSERT(i < PropertyName::NotAnIndex);
         slot.setValue(value);
         return true;
@@ -157 +157 @@
     unsigned i = propertyName.asIndex();
     if (JSValue value = thisObject->tryGetArgument(i)) {
-        ASSERT(i < PropertyName::NotAnIndex);
+        RELEASE_ASSERT(i < PropertyName::NotAnIndex);
         descriptor.setDescriptor(value, None);
         return true;
@@ -254 +254 @@
     unsigned i = propertyName.asIndex();
     if (i < thisObject->m_numArguments) {
-        ASSERT(i < PropertyName::NotAnIndex);
+        RELEASE_ASSERT(i < PropertyName::NotAnIndex);
         if (!Base::deleteProperty(cell, exec, propertyName))
             return false;
@@ -285 +285 @@
     unsigned i = propertyName.asIndex();
     if (i < thisObject->m_numArguments) {
-        ASSERT(i < PropertyName::NotAnIndex);
+        RELEASE_ASSERT(i < PropertyName::NotAnIndex);
         // If the property is not yet present on the object, and is not yet marked as deleted, then add it now.
         PropertySlot slot;
@@ -367 +367 @@
 void Arguments::didTearOffActivation(ExecState* exec, JSActivation* activation)
 {
-    ASSERT(activation);
+    RELEASE_ASSERT(activation);
     if (isTornOff())
         return;

trunk/Source/JavaScriptCore/runtime/ArrayPrototype.cpp

@@ -195 +195 @@
 void shift(ExecState* exec, JSObject* thisObj, unsigned header, unsigned currentCount, unsigned resultCount, unsigned length)
 {
-    ASSERT(currentCount > resultCount);
+    RELEASE_ASSERT(currentCount > resultCount);
     unsigned count = currentCount - resultCount;
 
-    ASSERT(header <= length);
-    ASSERT(currentCount <= (length - header));
+    RELEASE_ASSERT(header <= length);
+    RELEASE_ASSERT(currentCount <= (length - header));
 
     if (isJSArray(thisObj)) {
@@ -233 +233 @@
 void unshift(ExecState* exec, JSObject* thisObj, unsigned header, unsigned currentCount, unsigned resultCount, unsigned length)
 {
-    ASSERT(resultCount > currentCount);
+    RELEASE_ASSERT(resultCount > currentCount);
     unsigned count = resultCount - currentCount;
 
-    ASSERT(header <= length);
-    ASSERT(currentCount <= (length - header));
+    RELEASE_ASSERT(header <= length);
+    RELEASE_ASSERT(currentCount <= (length - header));
 
     // Guard against overflow.
@@ -1291 +1291 @@
     JSValue searchElement = exec->argument(0);
     do {
-        ASSERT(index < length);
+        RELEASE_ASSERT(index < length);
         JSValue e = getProperty(exec, thisObj, index);
         if (exec->hadException())

trunk/Source/JavaScriptCore/runtime/ButterflyInlines.h

@@ -75 +75 @@
 inline Butterfly* Butterfly::growPropertyStorage(JSGlobalData& globalData, size_t preCapacity, size_t oldPropertyCapacity, bool hasIndexingHeader, size_t indexingPayloadSizeInBytes, size_t newPropertyCapacity)
 {
-    ASSERT(newPropertyCapacity > oldPropertyCapacity);
+    RELEASE_ASSERT(newPropertyCapacity > oldPropertyCapacity);
     Butterfly* result = createUninitialized(
         globalData, preCapacity, newPropertyCapacity, hasIndexingHeader, indexingPayloadSizeInBytes);

trunk/Source/JavaScriptCore/runtime/CodeCache.cpp

@@ -161 +161 @@
     ExpressionNode* funcExpr = static_cast<ExprStatementNode*>(exprStatement)->expr();
     ASSERT(funcExpr);
-    ASSERT(funcExpr->isFuncExprNode());
+    RELEASE_ASSERT(funcExpr->isFuncExprNode());
     FunctionBodyNode* body = static_cast<FuncExprNode*>(funcExpr)->body();
     ASSERT(body);

trunk/Source/JavaScriptCore/runtime/CodeCache.h

@@ -81 +81 @@
         m_data[newIndex].first = key;
         m_data[newIndex].second = value;
-        ASSERT(m_map.size() <= CacheSize);
+        RELEASE_ASSERT(m_map.size() <= CacheSize);
     }
 

trunk/Source/JavaScriptCore/runtime/Completion.cpp

@@ -40 +40 @@
 {
     JSLockHolder lock(exec);
-    ASSERT(exec->globalData().identifierTable == wtfThreadData().currentIdentifierTable());
+    RELEASE_ASSERT(exec->globalData().identifierTable == wtfThreadData().currentIdentifierTable());
 
     ProgramExecutable* program = ProgramExecutable::create(exec, source);
@@ -83 +83 @@
     }
 
-    ASSERT(result);
+    RELEASE_ASSERT(result);
     return result;
 }

trunk/Source/JavaScriptCore/runtime/Executable.cpp

@@ -145 +145 @@
     , m_unlinkedExecutable(globalData, this, unlinkedExecutable)
 {
-    ASSERT(!source.isNull());
+    RELEASE_ASSERT(!source.isNull());
     ASSERT(source.length());
     m_firstLine = firstLine;
@@ -263 +263 @@
     if (!m_jitCodeForCall)
         return;
-    ASSERT(m_evalCodeBlock);
+    RELEASE_ASSERT(m_evalCodeBlock);
     m_evalCodeBlock->unlinkCalls();
 #endif
@@ -289 +289 @@
 JSObject* ProgramExecutable::compileOptimized(ExecState* exec, JSScope* scope, unsigned bytecodeIndex)
 {
-    ASSERT(exec->globalData().dynamicGlobalObject);
+    RELEASE_ASSERT(exec->globalData().dynamicGlobalObject);
     ASSERT(!!m_programCodeBlock);
     JSObject* error = 0;
@@ -352 +352 @@
     if (!m_jitCodeForCall)
         return;
-    ASSERT(m_programCodeBlock);
+    RELEASE_ASSERT(m_programCodeBlock);
     m_programCodeBlock->unlinkCalls();
 #endif
@@ -376 +376 @@
 JSObject* ProgramExecutable::initializeGlobalProperties(JSGlobalData& globalData, CallFrame* callFrame, JSScope* scope)
 {
-    ASSERT(scope);
+    RELEASE_ASSERT(scope);
     JSGlobalObject* globalObject = scope->globalObject();
-    ASSERT(globalObject);
+    RELEASE_ASSERT(globalObject);
     ASSERT(&globalObject->globalData() == &globalData);
 
@@ -443 +443 @@
         result = m_codeBlockForCall.get();
     else {
-        ASSERT(kind == CodeForConstruct);
+        RELEASE_ASSERT(kind == CodeForConstruct);
         result = m_codeBlockForConstruct.get();
     }
@@ -450 +450 @@
     while (result->alternative())
         result = static_cast<FunctionCodeBlock*>(result->alternative());
-    ASSERT(result);
+    RELEASE_ASSERT(result);
     ASSERT(JITCode::isBaselineCode(result->getJITType()));
     return result;
@@ -457 +457 @@
 JSObject* FunctionExecutable::compileOptimizedForCall(ExecState* exec, JSScope* scope, unsigned bytecodeIndex)
 {
-    ASSERT(exec->globalData().dynamicGlobalObject);
+    RELEASE_ASSERT(exec->globalData().dynamicGlobalObject);
     ASSERT(!!m_codeBlockForCall);
     JSObject* error = 0;
@@ -468 +468 @@
 JSObject* FunctionExecutable::compileOptimizedForConstruct(ExecState* exec, JSScope* scope, unsigned bytecodeIndex)
 {
-    ASSERT(exec->globalData().dynamicGlobalObject);
+    RELEASE_ASSERT(exec->globalData().dynamicGlobalObject);
     ASSERT(!!m_codeBlockForConstruct);
     JSObject* error = 0;
@@ -533 +533 @@
     
     m_numParametersForCall = m_codeBlockForCall->numParameters();
-    ASSERT(m_numParametersForCall);
+    RELEASE_ASSERT(m_numParametersForCall);
 
 #if ENABLE(JIT)
@@ -569 +569 @@
     
     m_numParametersForConstruct = m_codeBlockForConstruct->numParameters();
-    ASSERT(m_numParametersForConstruct);
+    RELEASE_ASSERT(m_numParametersForConstruct);
 
 #if ENABLE(JIT)
@@ -640 +640 @@
 #if ENABLE(JIT)
     if (!!m_jitCodeForCall) {
-        ASSERT(m_codeBlockForCall);
+        RELEASE_ASSERT(m_codeBlockForCall);
         m_codeBlockForCall->unlinkCalls();
     }
     if (!!m_jitCodeForConstruct) {
-        ASSERT(m_codeBlockForConstruct);
+        RELEASE_ASSERT(m_codeBlockForConstruct);
         m_codeBlockForConstruct->unlinkCalls();
     }
@@ -680 +680 @@
         return CodeBlockHash(static_cast<unsigned>(bitwise_cast<size_t>(m_function)));
     
-    ASSERT(kind == CodeForConstruct);
+    RELEASE_ASSERT(kind == CodeForConstruct);
     return CodeBlockHash(static_cast<unsigned>(bitwise_cast<size_t>(m_constructor)));
 }

trunk/Source/JavaScriptCore/runtime/Executable.h

@@ -430 +430 @@
         JSObject* compile(ExecState* exec, JSScope* scope)
         {
-            ASSERT(exec->globalData().dynamicGlobalObject);
+            RELEASE_ASSERT(exec->globalData().dynamicGlobalObject);
             JSObject* error = 0;
             if (!m_evalCodeBlock)
@@ -507 +507 @@
         JSObject* compile(ExecState* exec, JSScope* scope)
         {
-            ASSERT(exec->globalData().dynamicGlobalObject);
+            RELEASE_ASSERT(exec->globalData().dynamicGlobalObject);
             JSObject* error = 0;
             if (!m_programCodeBlock)
@@ -602 +602 @@
         JSObject* compileForCall(ExecState* exec, JSScope* scope)
         {
-            ASSERT(exec->globalData().dynamicGlobalObject);
+            RELEASE_ASSERT(exec->globalData().dynamicGlobalObject);
             JSObject* error = 0;
             if (!m_codeBlockForCall)
@@ -630 +630 @@
         JSObject* compileForConstruct(ExecState* exec, JSScope* scope)
         {
-            ASSERT(exec->globalData().dynamicGlobalObject);
+            RELEASE_ASSERT(exec->globalData().dynamicGlobalObject);
             JSObject* error = 0;
             if (!m_codeBlockForConstruct)

trunk/Source/JavaScriptCore/runtime/IndexingHeader.h

@@ -58 +58 @@
     void setVectorLength(uint32_t length)
     {
-        ASSERT(length <= maximumLength);
+        RELEASE_ASSERT(length <= maximumLength);
         m_vectorLength = length;
     }

trunk/Source/JavaScriptCore/runtime/JSArray.cpp

@@ -470 +470 @@
             return jsUndefined();
         
-        ASSERT(length < m_butterfly->vectorLength());
+        RELEASE_ASSERT(length < m_butterfly->vectorLength());
         JSValue value = m_butterfly->contiguous()[length].get();
         if (value) {
@@ -486 +486 @@
             return jsUndefined();
         
-        ASSERT(length < m_butterfly->vectorLength());
+        RELEASE_ASSERT(length < m_butterfly->vectorLength());
         double value = m_butterfly->contiguousDouble()[length];
         if (value == value) {
@@ -514 +514 @@
                 valueSlot.clear();
             
-                ASSERT(isLengthWritable());
+                RELEASE_ASSERT(isLengthWritable());
                 storage->setLength(index);
                 return element;
@@ -682 +682 @@
 {
     unsigned oldLength = storage->length();
-    ASSERT(count <= oldLength);
+    RELEASE_ASSERT(count <= oldLength);
     
     // If the array contains holes or is otherwise in an abnormal state,
@@ -737 +737 @@
 bool JSArray::shiftCountWithAnyIndexingType(ExecState* exec, unsigned startIndex, unsigned count)
 {
-    ASSERT(count > 0);
+    RELEASE_ASSERT(count > 0);
     
     switch (structure()->indexingType()) {
@@ -750 +750 @@
     case ArrayWithContiguous: {
         unsigned oldLength = m_butterfly->publicLength();
-        ASSERT(count <= oldLength);
+        RELEASE_ASSERT(count <= oldLength);
         
         // We may have to walk the entire array to do the shift. We're willing to do
@@ -785 +785 @@
     case ArrayWithDouble: {
         unsigned oldLength = m_butterfly->publicLength();
-        ASSERT(count <= oldLength);
+        RELEASE_ASSERT(count <= oldLength);
         
         // We may have to walk the entire array to do the shift. We're willing to do
@@ -833 +833 @@
     unsigned length = storage->length();
 
-    ASSERT(startIndex <= length);
+    RELEASE_ASSERT(startIndex <= length);
 
     // If the array contains holes or is otherwise in an abnormal state,

trunk/Source/JavaScriptCore/runtime/JSGlobalObjectFunctions.cpp

@@ -365 +365 @@
 static double jsStrDecimalLiteral(const CharType*& data, const CharType* end)
 {
-    ASSERT(data < end);
+    RELEASE_ASSERT(data < end);
 
     size_t parsedLength;

trunk/Source/JavaScriptCore/runtime/JSObject.cpp

@@ -136 +136 @@
                 currentTarget = newButterfly->contiguous();
                 currentSource = butterfly->contiguous();
-                ASSERT(newButterfly->publicLength() <= newButterfly->vectorLength());
+                RELEASE_ASSERT(newButterfly->publicLength() <= newButterfly->vectorLength());
                 count = newButterfly->vectorLength();
                 break;
@@ -1701 +1701 @@
 
     SparseArrayValueMap* map = m_butterfly->arrayStorage()->m_sparseMap.get();
-    ASSERT(map);
+    RELEASE_ASSERT(map);
 
     // 1. Let current be the result of calling the [[GetOwnProperty]] internal method of O with property name P.
@@ -1874 +1874 @@
     ensureLength(globalData, i + 1);
 
-    ASSERT(i < m_butterfly->vectorLength());
+    RELEASE_ASSERT(i < m_butterfly->vectorLength());
     switch (indexingShape) {
     case Int32Shape:

trunk/Source/JavaScriptCore/runtime/JSString.cpp

@@ -234 +234 @@
         return jsEmptyString(exec);
     ASSERT(!isRope());
-    ASSERT(i < m_value.length());
+    RELEASE_ASSERT(i < m_value.length());
     return jsSingleCharacterSubstring(exec, m_value, i);
 }

trunk/Source/JavaScriptCore/yarr/YarrInterpreter.cpp

@@ -84 +84 @@
     static inline void popParenthesesDisjunctionContext(BackTrackInfoParentheses* backTrack)
     {
-        ASSERT(backTrack->matchAmount);
-        ASSERT(backTrack->lastContext);
+        RELEASE_ASSERT(backTrack->matchAmount);
+        RELEASE_ASSERT(backTrack->lastContext);
         backTrack->lastContext = backTrack->lastContext->next;
         --backTrack->matchAmount;