Title: [208762] trunk
- Revision
- 208762
- Author
- fpi...@apple.com
- Date
- 2016-11-15 15:32:37 -0800 (Tue, 15 Nov 2016)
Log Message
[mac-wk1 debug] ASSERTION FAILED: thisObject->m_propertyTableUnsafe
https://bugs.webkit.org/show_bug.cgi?id=162986
Reviewed by Saam Barati.
Source/_javascript_Core:
This assertion is wrong for concurrent GC anyway, so this removes it.
* runtime/Structure.cpp:
(JSC::Structure::visitChildren):
LayoutTests:
This test should not crash anymore.
* platform/mac-wk1/TestExpectations:
Modified Paths
Diff
Modified: trunk/LayoutTests/ChangeLog (208761 => 208762)
--- trunk/LayoutTests/ChangeLog 2016-11-15 23:21:50 UTC (rev 208761)
+++ trunk/LayoutTests/ChangeLog 2016-11-15 23:32:37 UTC (rev 208762)
@@ -1,3 +1,14 @@
+2016-11-15 Filip Pizlo <fpi...@apple.com>
+
+ [mac-wk1 debug] ASSERTION FAILED: thisObject->m_propertyTableUnsafe
+ https://bugs.webkit.org/show_bug.cgi?id=162986
+
+ Reviewed by Saam Barati.
+
+ This test should not crash anymore.
+
+ * platform/mac-wk1/TestExpectations:
+
2016-11-15 Jiewen Tan <jiewen_...@apple.com>
js-test-pre.js::shouldReject doesn't need _rejectCallback and _resolveCallback
Modified: trunk/LayoutTests/platform/mac-wk1/TestExpectations (208761 => 208762)
--- trunk/LayoutTests/platform/mac-wk1/TestExpectations 2016-11-15 23:21:50 UTC (rev 208761)
+++ trunk/LayoutTests/platform/mac-wk1/TestExpectations 2016-11-15 23:32:37 UTC (rev 208762)
@@ -272,8 +272,6 @@
webkit.org/b/162507 http/tests/media/hls/hls-video-resize.html [ Pass Failure ]
-webkit.org/b/162986 inspector/formatting/formatting-_javascript_.html [ Pass Crash ]
-
webkit.org/b/161360 [ Release ] imported/w3c/web-platform-tests/html/browsers/browsing-the-web/history-traversal/persisted-user-state-restoration/scroll-restoration-fragment-scrolling-cross-origin.html [ Pass Failure ]
webkit.org/b/163598 media/modern-media-controls/macos-inline-media-controls/macos-inline-media-controls-buttons-styles.html [ Pass Failure ]
Modified: trunk/Source/_javascript_Core/ChangeLog (208761 => 208762)
--- trunk/Source/_javascript_Core/ChangeLog 2016-11-15 23:21:50 UTC (rev 208761)
+++ trunk/Source/_javascript_Core/ChangeLog 2016-11-15 23:32:37 UTC (rev 208762)
@@ -1,5 +1,17 @@
2016-11-15 Filip Pizlo <fpi...@apple.com>
+ [mac-wk1 debug] ASSERTION FAILED: thisObject->m_propertyTableUnsafe
+ https://bugs.webkit.org/show_bug.cgi?id=162986
+
+ Reviewed by Saam Barati.
+
+ This assertion is wrong for concurrent GC anyway, so this removes it.
+
+ * runtime/Structure.cpp:
+ (JSC::Structure::visitChildren):
+
+2016-11-15 Filip Pizlo <fpi...@apple.com>
+
Rename CONCURRENT_JIT/ConcurrentJIT to CONCURRENT_JS/ConcurrentJS
https://bugs.webkit.org/show_bug.cgi?id=164791
Modified: trunk/Source/_javascript_Core/runtime/Structure.cpp (208761 => 208762)
--- trunk/Source/_javascript_Core/runtime/Structure.cpp 2016-11-15 23:21:50 UTC (rev 208761)
+++ trunk/Source/_javascript_Core/runtime/Structure.cpp 2016-11-15 23:32:37 UTC (rev 208762)
@@ -1035,7 +1035,8 @@
visitor.append(&thisObject->m_previousOrRareData);
if (thisObject->isPinnedPropertyTable()) {
- ASSERT(thisObject->m_propertyTableUnsafe);
+ // NOTE: This can interleave in pin(), in which case it may see a null property table.
+ // That's fine, because then the barrier will fire and we will scan this again.
visitor.append(&thisObject->m_propertyTableUnsafe);
} else if (visitor.isBuildingHeapSnapshot())
visitor.append(&thisObject->m_propertyTableUnsafe);
_______________________________________________
webkit-changes mailing list
webkit-changes@lists.webkit.org
https://lists.webkit.org/mailman/listinfo/webkit-changes
