Changeset 96564 in webkit

Timestamp:

Oct 3, 2011 6:37:19 PM (13 years ago)

Author:

fpizlo@apple.com

Message:

JSC ASSERT Opening the Web Inspector
​https://bugs.webkit.org/show_bug.cgi?id=69293

Reviewed by Oliver Hunt.

If a polymorphic access structure list has a duplicated structure, then
don't crash.

• dfg/DFGByteCodeParser.cpp:

(JSC::DFG::ByteCodeParser::parseBlock):

Location:

trunk/Source/JavaScriptCore

Files:

• ChangeLog (modified) (1 diff)
• dfg/DFGByteCodeParser.cpp (modified) (1 diff)

trunk/Source/JavaScriptCore/ChangeLog

@@ +1 @@
+2011-10-03  Filip Pizlo  <fpizlo@apple.com>
+
+        JSC ASSERT Opening the Web Inspector
+        https://bugs.webkit.org/show_bug.cgi?id=69293
+
+        Reviewed by Oliver Hunt.
+        
+        If a polymorphic access structure list has a duplicated structure, then
+        don't crash.
+
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::parseBlock):
+
 2011-10-03  Gavin Barraclough  <barraclough@apple.com>
 

trunk/Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp

@@ -1192 +1192 @@
                         
                         Structure* structure = list->list[i].base.get();
+                        if (structureSet.contains(structure))
+                            continue;
+                        
                         size_t myOffset = structure->get(*m_globalData, identifier);