Title: [176506] trunk/Source/_javascript_Core
- Revision
- 176506
- Author
- msab...@apple.com
- Date
- 2014-11-22 11:07:26 -0800 (Sat, 22 Nov 2014)
Log Message
r176455: ASSERT(!m_vector.isEmpty()) in IntendedStructureChain.cpp(143)
https://bugs.webkit.org/show_bug.cgi?id=139000
Reviewed by Darin Adler.
Check that the chainCount is non-zero before using a StructureChain.
* bytecode/ComplexGetStatus.cpp:
(JSC::ComplexGetStatus::computeFor):
Modified Paths
Diff
Modified: trunk/Source/_javascript_Core/ChangeLog (176505 => 176506)
--- trunk/Source/_javascript_Core/ChangeLog 2014-11-22 18:18:11 UTC (rev 176505)
+++ trunk/Source/_javascript_Core/ChangeLog 2014-11-22 19:07:26 UTC (rev 176506)
@@ -1,5 +1,17 @@
2014-11-21 Michael Saboff <msab...@apple.com>
+ r176455: ASSERT(!m_vector.isEmpty()) in IntendedStructureChain.cpp(143)
+ https://bugs.webkit.org/show_bug.cgi?id=139000
+
+ Reviewed by Darin Adler.
+
+ Check that the chainCount is non-zero before using a StructureChain.
+
+ * bytecode/ComplexGetStatus.cpp:
+ (JSC::ComplexGetStatus::computeFor):
+
+2014-11-21 Michael Saboff <msab...@apple.com>
+
Allocate local ScopeChain register
https://bugs.webkit.org/show_bug.cgi?id=138793
Modified: trunk/Source/_javascript_Core/bytecode/ComplexGetStatus.cpp (176505 => 176506)
--- trunk/Source/_javascript_Core/bytecode/ComplexGetStatus.cpp 2014-11-22 18:18:11 UTC (rev 176505)
+++ trunk/Source/_javascript_Core/bytecode/ComplexGetStatus.cpp 2014-11-22 19:07:26 UTC (rev 176506)
@@ -46,7 +46,7 @@
ComplexGetStatus result;
result.m_kind = Inlineable;
- if (chain) {
+ if (chain && chainCount) {
result.m_chain = adoptRef(new IntendedStructureChain(
profiledBlock, headStructure, chain, chainCount));
_______________________________________________
webkit-changes mailing list
webkit-changes@lists.webkit.org
https://lists.webkit.org/mailman/listinfo/webkit-changes
