Title: [219109] trunk/Source/_javascript_Core
- Revision
- 219109
- Author
- [email protected]
- Date
- 2017-07-03 17:10:29 -0700 (Mon, 03 Jul 2017)
Log Message
Add a new assertion to object allocation sinking phase
https://bugs.webkit.org/show_bug.cgi?id=174107
Rubber stamped by Filip Pizlo.
* dfg/DFGObjectAllocationSinkingPhase.cpp:
Modified Paths
Diff
Modified: trunk/Source/_javascript_Core/ChangeLog (219108 => 219109)
--- trunk/Source/_javascript_Core/ChangeLog 2017-07-03 23:44:39 UTC (rev 219108)
+++ trunk/Source/_javascript_Core/ChangeLog 2017-07-04 00:10:29 UTC (rev 219109)
@@ -1,3 +1,12 @@
+2017-07-03 Saam Barati <[email protected]>
+
+ Add a new assertion to object allocation sinking phase
+ https://bugs.webkit.org/show_bug.cgi?id=174107
+
+ Rubber stamped by Filip Pizlo.
+
+ * dfg/DFGObjectAllocationSinkingPhase.cpp:
+
2017-07-03 Commit Queue <[email protected]>
Unreviewed, rolling out r219060.
Modified: trunk/Source/_javascript_Core/dfg/DFGObjectAllocationSinkingPhase.cpp (219108 => 219109)
--- trunk/Source/_javascript_Core/dfg/DFGObjectAllocationSinkingPhase.cpp 2017-07-03 23:44:39 UTC (rev 219108)
+++ trunk/Source/_javascript_Core/dfg/DFGObjectAllocationSinkingPhase.cpp 2017-07-04 00:10:29 UTC (rev 219109)
@@ -2181,6 +2181,7 @@
return a->getConcurrently(uid) < b->getConcurrently(uid);
});
+ RELEASE_ASSERT(structures.size());
PropertyOffset firstOffset = structures[0]->getConcurrently(uid);
if (firstOffset == structures.last()->getConcurrently(uid)) {
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes
