Title: [250172] trunk/Source/_javascript_Core
- Revision
- 250172
- Author
- mark....@apple.com
- Date
- 2019-09-20 17:29:13 -0700 (Fri, 20 Sep 2019)
Log Message
Harden assertion in StructureIDTable::get().
https://bugs.webkit.org/show_bug.cgi?id=202067
<rdar://problem/55577923>
Reviewed by Keith Miller.
* runtime/StructureIDTable.h:
(JSC::StructureIDTable::get):
Modified Paths
Diff
Modified: trunk/Source/_javascript_Core/ChangeLog (250171 => 250172)
--- trunk/Source/_javascript_Core/ChangeLog 2019-09-21 00:17:27 UTC (rev 250171)
+++ trunk/Source/_javascript_Core/ChangeLog 2019-09-21 00:29:13 UTC (rev 250172)
@@ -1,3 +1,14 @@
+2019-09-20 Mark Lam <mark....@apple.com>
+
+ Harden assertion in StructureIDTable::get().
+ https://bugs.webkit.org/show_bug.cgi?id=202067
+ <rdar://problem/55577923>
+
+ Reviewed by Keith Miller.
+
+ * runtime/StructureIDTable.h:
+ (JSC::StructureIDTable::get):
+
2019-09-20 Truitt Savell <tsav...@apple.com>
Unreviewed, rolling out r250114.
Modified: trunk/Source/_javascript_Core/runtime/StructureIDTable.h (250171 => 250172)
--- trunk/Source/_javascript_Core/runtime/StructureIDTable.h 2019-09-21 00:17:27 UTC (rev 250171)
+++ trunk/Source/_javascript_Core/runtime/StructureIDTable.h 2019-09-21 00:29:13 UTC (rev 250172)
@@ -172,7 +172,7 @@
ASSERT_WITH_SECURITY_IMPLICATION(structureID);
ASSERT_WITH_SECURITY_IMPLICATION(!isNuked(structureID));
uint32_t structureIndex = structureID >> s_numberOfEntropyBits;
- ASSERT_WITH_SECURITY_IMPLICATION(structureIndex < m_capacity);
+ RELEASE_ASSERT_WITH_SECURITY_IMPLICATION(structureIndex < m_capacity);
return decode(table()[structureIndex].encodedStructureBits, structureID);
}
_______________________________________________
webkit-changes mailing list
webkit-changes@lists.webkit.org
https://lists.webkit.org/mailman/listinfo/webkit-changes
