133903 2014-06-14 09:35:56 -0700 Convert ASSERT in inlineFunctionForCapabilityLevel to early return 2014-06-16 13:46:32 -0700 1 1 1 Unclassified WebKit JavaScriptCore 528+ (Nightly build) Unspecified Unspecified RESOLVED FIXED P2 Normal --- 1 msaboff msaboff oldest_to_newest 1015661 0 msaboff 2014-06-14 09:35:56 -0700 inlineFunctionForCapabilityLevel() begins with: if (isClosureCall) { ASSERT(kind == CodeForCall); return inlineFunctionForClosureCallCapabilityLevel(codeBlock); } In some cases inlineFunctionForCapabilityLevel is called with isClosureCall true for CodeForConstruct. In release builds we'll do the wrong thing. Instead we should return CannotCompile. 1015663 1 233109 msaboff 2014-06-14 09:49:41 -0700 Created attachment 233109 Patch 1015878 2 233109 mhahnenberg 2014-06-16 09:37:37 -0700 Comment on attachment 233109 Patch r=me 1015879 3 msaboff 2014-06-16 09:41:29 -0700 Committed r170011: <http://trac.webkit.org/changeset/170011> 1015907 4 233109 ggaren 2014-06-16 11:54:36 -0700 Comment on attachment 233109 Patch Seems like this should be pretty easy to test in a debug build. Can you add a test case? 1015949 5 msaboff 2014-06-16 13:46:32 -0700 (In reply to comment #4) > (From update of attachment 233109 [details]) > Seems like this should be pretty easy to test in a debug build. Can you add a test case? I don't know about easy. In testing on a debug build, I hit this very infrequently, say ~20 minutes. I will look into writing a test that can reliably hit this case. Tracked in <https://bugs.webkit.org/show_bug.cgi?id=133950> - "Add test for case where inlineFunctionForCapabilityLevel() is called for a constructor and isClosureCall is true" 233109 2014-06-14 09:49:41 -0700 2014-06-16 11:54:36 -0700 Patch 133903.patch text/plain 1476 msaboff SW5kZXg6IFNvdXJjZS9KYXZhU2NyaXB0Q29yZS9DaGFuZ2VMb2cKPT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PQotLS0gU291 cmNlL0phdmFTY3JpcHRDb3JlL0NoYW5nZUxvZwkocmV2aXNpb24gMTY5OTcwKQorKysgU291cmNl L0phdmFTY3JpcHRDb3JlL0NoYW5nZUxvZwkod29ya2luZyBjb3B5KQpAQCAtMSwzICsxLDE1IEBA CisyMDE0LTA2LTE0ICBNaWNoYWVsIFNhYm9mZiAgPG1zYWJvZmZAYXBwbGUuY29tPgorCisgICAg ICAgIENvbnZlcnQgQVNTRVJUIGluIGlubGluZUZ1bmN0aW9uRm9yQ2FwYWJpbGl0eUxldmVsIHRv IGVhcmx5IHJldHVybgorICAgICAgICBodHRwczovL2J1Z3Mud2Via2l0Lm9yZy9zaG93X2J1Zy5j Z2k/aWQ9MTMzOTAzCisKKyAgICAgICAgUmV2aWV3ZWQgYnkgTk9CT0RZIChPT1BTISkuCisKKyAg ICAgICAgSGFyZGVuZWQgY29kZSBieSBDb252ZXJ0aW5nIEFTU0VSVCB0byByZXR1cm4gQ2Fubm90 Q29tcGlsZS4KKworICAgICAgICAqIGRmZy9ERkdDYXBhYmlsaXRpZXMuaDoKKyAgICAgICAgKEpT Qzo6REZHOjppbmxpbmVGdW5jdGlvbkZvckNhcGFiaWxpdHlMZXZlbCk6CisKIDIwMTQtMDYtMTMg IE1hcmsgSGFobmVuYmVyZyAgPG1oYWhuZW5iZXJnQGFwcGxlLmNvbT4KIAogICAgICAgICBPU1Ig ZXhpdCBzaG91bGQgYmFycmllciB0aGUgRXhlY3V0YWJsZXMgZm9yIGFsbCBJbmxpbmVDYWxsRnJh bWVzLCBub3QganVzdCB0aG9zZSBvbiB0aGUgc3RhY2sgYXQgdGhlIHRpbWUgb2YgZXhpdApJbmRl eDogU291cmNlL0phdmFTY3JpcHRDb3JlL2RmZy9ERkdDYXBhYmlsaXRpZXMuaAo9PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 Ci0tLSBTb3VyY2UvSmF2YVNjcmlwdENvcmUvZGZnL0RGR0NhcGFiaWxpdGllcy5oCShyZXZpc2lv biAxNjk5NzApCisrKyBTb3VyY2UvSmF2YVNjcmlwdENvcmUvZGZnL0RGR0NhcGFiaWxpdGllcy5o CSh3b3JraW5nIGNvcHkpCkBAIC0xNDksNyArMTQ5LDggQEAgaW5saW5lIGJvb2wgbWlnaHRJbmxp bmVGdW5jdGlvbihDb2RlQmxvYwogaW5saW5lIENhcGFiaWxpdHlMZXZlbCBpbmxpbmVGdW5jdGlv bkZvckNhcGFiaWxpdHlMZXZlbChDb2RlQmxvY2sqIGNvZGVCbG9jaywgQ29kZVNwZWNpYWxpemF0 aW9uS2luZCBraW5kLCBib29sIGlzQ2xvc3VyZUNhbGwpCiB7CiAgICAgaWYgKGlzQ2xvc3VyZUNh bGwpIHsKLSAgICAgICAgQVNTRVJUKGtpbmQgPT0gQ29kZUZvckNhbGwpOworICAgICAgICBpZiAo a2luZCAhPSBDb2RlRm9yQ2FsbCkKKyAgICAgICAgICAgIHJldHVybiBDYW5ub3RDb21waWxlOwog ICAgICAgICByZXR1cm4gaW5saW5lRnVuY3Rpb25Gb3JDbG9zdXJlQ2FsbENhcGFiaWxpdHlMZXZl bChjb2RlQmxvY2spOwogICAgIH0KICAgICBpZiAoa2luZCA9PSBDb2RlRm9yQ2FsbCkK