110519 2013-02-21 15:09:44 -0800 Object allocation profiling will refuse to create objects with more than JSFinalObject::maxInlineCapacity() inline slots, but JSFunction::allocationProfile() asserts that the number of inline slots is always what it asked for 2013-02-21 16:57:48 -0800 1 1 1 Unclassified WebKit JavaScriptCore 528+ (Nightly build) All All RESOLVED FIXED P2 Normal --- 1 fpizlo fpizlo barraclough ggaren mark.lam mhahnenberg msaboff oliver sam oldest_to_newest 838884 0 fpizlo 2013-02-21 15:09:44 -0800 Basically, JSFunction is asserting that the object allocation profiling doesn't have the max-out feature. But it does have that feature, for good reason. 838888 1 189608 fpizlo 2013-02-21 15:10:55 -0800 Created attachment 189608 tbhe patch 838891 2 189608 ggaren 2013-02-21 15:13:12 -0800 Comment on attachment 189608 tbhe patch r=me Would be nice to rename the argument to inferredInlineCapacity, too. The convention is that "inlineCapacity" means the real number, and not the guess. 838937 3 fpizlo 2013-02-21 15:43:36 -0800 (In reply to comment #2) > (From update of attachment 189608 [details]) > r=me > > Would be nice to rename the argument to inferredInlineCapacity, too. The convention is that "inlineCapacity" means the real number, and not the guess. I'll leave that for later. Also, there's no good test for this. The key thing is that the JSFunction must survive but the CodeBlock must be blown away. Otherwise we never take that path in JSFunction::allocationProfile(). 839028 4 fpizlo 2013-02-21 16:57:48 -0800 Landed in http://trac.webkit.org/changeset/143667 189608 2013-02-21 15:10:55 -0800 2013-02-21 15:13:12 -0800 tbhe patch blah.patch text/plain 1455 fpizlo SW5kZXg6IFNvdXJjZS9KYXZhU2NyaXB0Q29yZS9DaGFuZ2VMb2cKPT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PQotLS0gU291 cmNlL0phdmFTY3JpcHRDb3JlL0NoYW5nZUxvZwkocmV2aXNpb24gMTQzNjU0KQorKysgU291cmNl L0phdmFTY3JpcHRDb3JlL0NoYW5nZUxvZwkod29ya2luZyBjb3B5KQpAQCAtMSwzICsxLDEzIEBA CisyMDEzLTAyLTIxICBGaWxpcCBQaXpsbyAgPGZwaXpsb0BhcHBsZS5jb20+CisKKyAgICAgICAg T2JqZWN0IGFsbG9jYXRpb24gcHJvZmlsaW5nIHdpbGwgcmVmdXNlIHRvIGNyZWF0ZSBvYmplY3Rz IHdpdGggbW9yZSB0aGFuIEpTRmluYWxPYmplY3Q6Om1heElubGluZUNhcGFjaXR5KCkgaW5saW5l IHNsb3RzLCBidXQgSlNGdW5jdGlvbjo6YWxsb2NhdGlvblByb2ZpbGUoKSBhc3NlcnRzIHRoYXQg dGhlIG51bWJlciBvZiBpbmxpbmUgc2xvdHMgaXMgYWx3YXlzIHdoYXQgaXQgYXNrZWQgZm9yCisg ICAgICAgIGh0dHBzOi8vYnVncy53ZWJraXQub3JnL3Nob3dfYnVnLmNnaT9pZD0xMTA1MTkKKwor ICAgICAgICBSZXZpZXdlZCBieSBOT0JPRFkgKE9PUFMhKS4KKyAgICAgICAgCisgICAgICAgICog cnVudGltZS9KU0Z1bmN0aW9uLmg6CisgICAgICAgIChKU0M6OkpTRnVuY3Rpb246OmFsbG9jYXRp b25Qcm9maWxlKToKKwogMjAxMy0wMi0yMCAgRmlsaXAgUGl6bG8gIDxmcGl6bG9AYXBwbGUuY29t PgogCiAgICAgICAgIERGRyBzaG91bGQgbm90IGNoYW5nZSBpdHMgbWluZCBhYm91dCB3aGF0IHR5 cGUgc3BlY3VsYXRpb25zIGEgbm9kZSBkb2VzLCBieSBlbmNvZGluZyB0aGUgY2hlY2tzIGluIHRo ZSBOb2RlVHlwZSwgVXNlS2luZCwgYW5kIEFycmF5TW9kZQpJbmRleDogU291cmNlL0phdmFTY3Jp cHRDb3JlL3J1bnRpbWUvSlNGdW5jdGlvbi5oCj09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT0KLS0tIFNvdXJjZS9KYXZhU2Ny aXB0Q29yZS9ydW50aW1lL0pTRnVuY3Rpb24uaAkocmV2aXNpb24gMTQzNjUxKQorKysgU291cmNl L0phdmFTY3JpcHRDb3JlL3J1bnRpbWUvSlNGdW5jdGlvbi5oCSh3b3JraW5nIGNvcHkpCkBAIC0x MzYsNyArMTM2LDYgQEAgbmFtZXNwYWNlIEpTQyB7CiAgICAgICAgIHsKICAgICAgICAgICAgIGlm IChVTkxJS0VMWShtX2FsbG9jYXRpb25Qcm9maWxlLmlzTnVsbCgpKSkKICAgICAgICAgICAgICAg ICByZXR1cm4gY3JlYXRlQWxsb2NhdGlvblByb2ZpbGUoZXhlYywgaW5saW5lQ2FwYWNpdHkpOwot ICAgICAgICAgICAgQVNTRVJUKGlubGluZUNhcGFjaXR5IDw9IG1fYWxsb2NhdGlvblByb2ZpbGUu c3RydWN0dXJlKCktPmlubGluZUNhcGFjaXR5KCkpOwogICAgICAgICAgICAgcmV0dXJuICZtX2Fs bG9jYXRpb25Qcm9maWxlOwogICAgICAgICB9CiAK