Changeset 183069 in webkit

Timestamp:

Apr 21, 2015 11:50:16 AM (9 years ago)

Author:

commit-queue@webkit.org

Message:

REGRESSION (r182899): icloud.com crashes
​https://bugs.webkit.org/show_bug.cgi?id=143960

Patch by Basile Clement <​basile_clement@apple.com> on 2015-04-21
Reviewed by Filip Pizlo.

• runtime/JSFunction.h:

(JSC::JSFunction::allocationStructure):

• tests/stress/dfg-rare-data.js: Added.

(F): Regression test

Location:

trunk/Source/JavaScriptCore

Files:

• ChangeLog (modified) (1 diff)
• runtime/JSFunction.h (modified) (1 diff)
• tests/stress/dfg-rare-data.js (added)

trunk/Source/JavaScriptCore/ChangeLog

@@ +1 @@
+2015-04-21  Basile Clement  <basile_clement@apple.com>
+
+        REGRESSION (r182899): icloud.com crashes
+        https://bugs.webkit.org/show_bug.cgi?id=143960
+
+        Reviewed by Filip Pizlo.
+
+        * runtime/JSFunction.h:
+        (JSC::JSFunction::allocationStructure):
+        * tests/stress/dfg-rare-data.js: Added.
+        (F): Regression test
+
 2015-04-21  Michael Saboff  <msaboff@apple.com>
 

trunk/Source/JavaScriptCore/runtime/JSFunction.h

@@ -119 +119 @@
     Structure* allocationStructure()
     {
-        ASSERT(m_rareData);
+        if (!m_rareData)
+            return nullptr;
+
         return m_rareData.get()->allocationStructure();
     }