Changeset 87406 in webkit
- Timestamp:
- May 26, 2011 11:43:40 AM (13 years ago)
- Location:
- trunk/Source/JavaScriptCore
- Files:
-
- 2 edited
Legend:
- Unmodified
- Added
- Removed
-
trunk/Source/JavaScriptCore/ChangeLog
r87377 r87406 1 2011-05-26 Geoffrey Garen <ggaren@apple.com> 2 3 Reviewed by Oliver Hunt. 4 5 Provide a real owner when copying a property table, for the sake of 6 write barriers. 7 https://bugs.webkit.org/show_bug.cgi?id=61547 8 9 No test because we can't enable the writeBarrier() ASSERT just yet. 10 11 * runtime/Structure.cpp: 12 (JSC::Structure::addPropertyTransition): 13 1 14 2011-05-26 Adam Roben <aroben@apple.com> 2 15 -
trunk/Source/JavaScriptCore/runtime/Structure.cpp
r86499 r87406 367 367 if (structure->m_propertyTable) { 368 368 if (structure->m_isPinnedPropertyTable) 369 transition->m_propertyTable = structure->m_propertyTable->copy(globalData, 0, structure->m_propertyTable->size() + 1);369 transition->m_propertyTable = structure->m_propertyTable->copy(globalData, transition, structure->m_propertyTable->size() + 1); 370 370 else 371 371 transition->m_propertyTable = structure->m_propertyTable.release();
Note: See TracChangeset
for help on using the changeset viewer.