Bug 110155 – Structure::flattenDictionaryStructure should compute max offset in a manner that soundly handles the case where the property list becomes empty

• Component: JavaScriptCore
• Status: RESOLVED FIXED

[Filip Pizlo]

This was a rookie mistake.  It was doing:

for (blah) {
   m_offset = foo // foo's monotonically increase in the loop
}

as a way of computing max offset for all of the properties.  Except what if the loop doesn't execute because there are no properties?  Well, then, you're going to have a bogus m_offset.

The solution is to initialize m_offset at the top of the loop.

[Filip Pizlo]

<rdar://problem/13233773>

[Filip Pizlo]

Created attachment 188945 [details]
the patch

[Filip Pizlo]

Comment on attachment 188945 [details]
the patch

View in context: https://bugs.webkit.org/attachment.cgi?id=188945&action=review

> Source/WTF/wtf/DataLog.cpp:80
> -        if (!file)
> +        if (!file) {
>              fprintf(stderr, "Warning: Could not open log file %s for writing.\n", actualFilename);
> +            CRASH();
> +        }

Oops, I will back this out.

[Filip Pizlo]

Created attachment 188946 [details]
the patch

[Filip Pizlo]

Landed in http://trac.webkit.org/changeset/143269

[Filip Pizlo]

*** Bug 110154 has been marked as a duplicate of this bug. ***