Title: [232952] trunk/Source/_javascript_Core
- Revision
- 232952
- Author
- [email protected]
- Date
- 2018-06-18 18:27:11 -0700 (Mon, 18 Jun 2018)
Log Message
Unreviewed, remove bad assertion.
* runtime/JSArray.cpp:
(JSC::JSArray::tryCreateUninitializedRestricted):
Modified Paths
Diff
Modified: trunk/Source/_javascript_Core/ChangeLog (232951 => 232952)
--- trunk/Source/_javascript_Core/ChangeLog 2018-06-18 23:53:27 UTC (rev 232951)
+++ trunk/Source/_javascript_Core/ChangeLog 2018-06-19 01:27:11 UTC (rev 232952)
@@ -1,5 +1,12 @@
2018-06-18 Keith Miller <[email protected]>
+ Unreviewed, remove bad assertion.
+
+ * runtime/JSArray.cpp:
+ (JSC::JSArray::tryCreateUninitializedRestricted):
+
+2018-06-18 Keith Miller <[email protected]>
+
Properly zero unused property storage offsets
https://bugs.webkit.org/show_bug.cgi?id=186692
Modified: trunk/Source/_javascript_Core/runtime/JSArray.cpp (232951 => 232952)
--- trunk/Source/_javascript_Core/runtime/JSArray.cpp 2018-06-18 23:53:27 UTC (rev 232951)
+++ trunk/Source/_javascript_Core/runtime/JSArray.cpp 2018-06-19 01:27:11 UTC (rev 232952)
@@ -52,7 +52,6 @@
unsigned outOfLineStorage = structure->outOfLineCapacity();
JSGlobalObject* globalObject = structure->globalObject();
- ASSERT_UNUSED(globalObject, globalObject->isOriginalArrayStructure(structure) || structure == globalObject->regExpMatchesArrayStructure() || structure == globalObject->regExpMatchesArrayWithGroupsStructure());
Butterfly* butterfly;
IndexingType indexingType = structure->indexingType();
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes
