Attachment 343134 Details for Bug 186830 – Patch

[patch] Patch

bug-186830-20180619225524.patch (text/plain), 1.80 KB, created by Keith Miller on 2018-06-19 22:55:25 PDT

(hide)

Description:

Filename:

MIME Type:

Creator: Keith Miller

Created: 2018-06-19 22:55:25 PDT

Size: 1.80 KB

patch

obsolete

>Subversion Revision: 233001
>diff --git a/Source/JavaScriptCore/ChangeLog b/Source/JavaScriptCore/ChangeLog
>index 7ce090990729cb1ac42a8f347dc692a279da3612..f0b3194bfbeccb59b6fc319543eeb6d7633873df 100644
>--- a/Source/JavaScriptCore/ChangeLog
>+++ b/Source/JavaScriptCore/ChangeLog
>@@ -1,3 +1,17 @@
>+2018-06-19  Keith Miller  <keith_miller@apple.com>
>+
>+        Fix broken assertion on 32-bit
>+        https://bugs.webkit.org/show_bug.cgi?id=186830
>+
>+        Reviewed by NOBODY (OOPS!).
>+
>+        The assertion was intended to catch concurrent GC issues. We don't
>+        run them on 32-bit so we don't need this assertion there. The
>+        assertion was broken because zero is not JSValue() on 32-bit.
>+
>+        * runtime/JSObjectInlines.h:
>+        (JSC::JSObject::prepareToPutDirectWithoutTransition):
>+
> 2018-06-19  Keith Miller  <keith_miller@apple.com>
> 
>         flattenDictionaryStructure needs to zero properties that have been compressed away
>diff --git a/Source/JavaScriptCore/runtime/JSObjectInlines.h b/Source/JavaScriptCore/runtime/JSObjectInlines.h
>index ba480e39edc25a5be13aed280dd6ef1dc42aa790..ec331a139d6341f7bd78e4f1ece59ec2ddc924a7 100644
>--- a/Source/JavaScriptCore/runtime/JSObjectInlines.h
>+++ b/Source/JavaScriptCore/runtime/JSObjectInlines.h
>@@ -203,7 +203,10 @@ ALWAYS_INLINE PropertyOffset JSObject::prepareToPutDirectWithoutTransition(VM& v
>                 setStructureIDDirectly(structureID);
>             } else
>                 structure->setLastOffset(newLastOffset);
>-            ASSERT(!getDirect(offset));
>+
>+            // This assertion verifies that the concurrent GC won't read garbage if the concurrentGC
>+            // is running at the same time we put without transitioning.
>+            ASSERT(!JSValue::encode(getDirect(offset)));
>             result = offset;
>         });
>     return result;

Actions: View | Formatted Diff | Diff

Attachments on bug 186830: 343133 | 343134