Bug 159227

Summary: JSRopeString should use release asserts, not debug asserts, about substring bounds
Product: WebKit Reporter: Filip Pizlo <fpizlo>
Component: JavaScriptCoreAssignee: Filip Pizlo <fpizlo>
Status: RESOLVED FIXED    
Severity: Normal CC: commit-queue, keith_miller, mark.lam, msaboff, sbarati
Priority: P2    
Version: WebKit Nightly Build   
Hardware: All   
OS: All   
Attachments:
Description Flags
the patch sbarati: review+

Description Filip Pizlo 2016-06-28 14:00:04 PDT 
According to my experiments this change costs nothing.  That's not surprising since the most common way to construct a rope these days is inlined into the JIT, which does its own safety checks.  This makes us crash sooner rather than corrupting memory.
Comment 1 Filip Pizlo 2016-06-28 14:01:08 PDT 
Created attachment 282282 [details]
the patch
Comment 2 Filip Pizlo 2016-06-28 14:04:04 PDT 
Landed in https://trac.webkit.org/changeset/202585