Bug 195858

Summary: REGRESSION: !vm.isInitializingObject() void* JSC::tryAllocateCellHelper<JSC::Structure> JSC::Structure::create
Product: WebKit Reporter: Yusuke Suzuki <ysuzuki>
Component: JavaScriptCoreAssignee: Yusuke Suzuki <ysuzuki>
Status: RESOLVED FIXED    
Severity: Normal CC: alecflett, beidson, commit-queue, ews-watchlist, jsbell, keith_miller, mark.lam, msaboff, saam, webkit-bug-importer
Priority: P2 Keywords: InRadar
Version: WebKit Nightly Build   
Hardware: Unspecified   
OS: Unspecified   
Attachments:
Description Flags
Patch
none
Patch none

Description Yusuke Suzuki 2019-03-16 20:27:50 PDT
Wasm structures should be passed to ::create functions.
Comment 1 Yusuke Suzuki 2019-03-16 20:28:46 PDT
<rdar://problem/48954352>
Comment 2 Radar WebKit Bug Importer 2019-03-16 20:28:54 PDT
<rdar://problem/48958544>
Comment 3 Yusuke Suzuki 2019-03-16 21:00:10 PDT
Created attachment 364958 [details]
Patch
Comment 4 Yusuke Suzuki 2019-03-16 21:12:48 PDT
Created attachment 364959 [details]
Patch
Comment 5 Mark Lam 2019-03-16 22:14:19 PDT
Comment on attachment 364959 [details]
Patch

r=me
Comment 6 Mark Lam 2019-03-16 23:32:57 PDT
<rdar://problem/48954352>
Comment 7 Yusuke Suzuki 2019-03-17 00:20:40 PDT
Comment on attachment 364959 [details]
Patch

Thanks!
Comment 8 WebKit Commit Bot 2019-03-17 00:46:01 PDT
Comment on attachment 364959 [details]
Patch

Clearing flags on attachment: 364959

Committed r243051: <https://trac.webkit.org/changeset/243051>
Comment 9 WebKit Commit Bot 2019-03-17 00:46:03 PDT
All reviewed patches have been landed.  Closing bug.