Changeset 233217 in webkit

Timestamp:

Jun 26, 2018 1:37:30 PM (6 years ago)

Author:

mark.lam@apple.com

Message:

ASSERTION FAILED: length > butterfly->vectorLength() in JSObject::ensureLengthSlow().
​https://bugs.webkit.org/show_bug.cgi?id=187060
<rdar://problem/41452767>

Reviewed by Keith Miller.

JSTests:

• stress/regress-187060.js: Added.

Source/JavaScriptCore:

JSObject::ensureLengthSlow() may be called only because it needs to do a copy on
write conversion. Hence, we can return early after the conversion if the vector
length is already sufficient to cover the requested length.

• runtime/JSObject.cpp:

(JSC::JSObject::ensureLengthSlow):

Location:

trunk

Files:

• JSTests/ChangeLog (modified) (1 diff)
• JSTests/stress/regress-187060.js (added)
• Source/JavaScriptCore/ChangeLog (modified) (1 diff)
• Source/JavaScriptCore/runtime/JSObject.cpp (modified) (1 diff)

trunk/JSTests/ChangeLog

@@ +1 @@
+2018-06-26  Mark Lam  <mark.lam@apple.com>
+
+        ASSERTION FAILED: length > butterfly->vectorLength() in JSObject::ensureLengthSlow().
+        https://bugs.webkit.org/show_bug.cgi?id=187060
+        <rdar://problem/41452767>
+
+        Reviewed by Keith Miller.
+
+        * stress/regress-187060.js: Added.
+
 2018-06-25  Mark Lam  <mark.lam@apple.com>
 

trunk/Source/JavaScriptCore/ChangeLog

@@ +1 @@
+2018-06-26  Mark Lam  <mark.lam@apple.com>
+
+        ASSERTION FAILED: length > butterfly->vectorLength() in JSObject::ensureLengthSlow().
+        https://bugs.webkit.org/show_bug.cgi?id=187060
+        <rdar://problem/41452767>
+
+        Reviewed by Keith Miller.
+
+        JSObject::ensureLengthSlow() may be called only because it needs to do a copy on
+        write conversion.  Hence, we can return early after the conversion if the vector
+        length is already sufficient to cover the requested length.
+
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::ensureLengthSlow):
+
 2018-06-26  Commit Queue  <commit-queue@webkit.org>
 

trunk/Source/JavaScriptCore/runtime/JSObject.cpp

@@ -3263 +3263 @@
 bool JSObject::ensureLengthSlow(VM& vm, unsigned length)
 {
-    if (isCopyOnWrite(indexingMode()))
+    if (isCopyOnWrite(indexingMode())) {
         convertFromCopyOnWrite(vm);
+        if (m_butterfly->vectorLength() >= length)
+            return true;
+    }
 
     Butterfly* butterfly = this->butterfly();