Changeset 130228 in webkit for trunk/Source/JavaScriptCore/runtime/Structure.cpp

Timestamp:

Oct 2, 2012, 4:22:23 PM (13 years ago)

Author:

[email protected]

Message:

REGRESSION(r128400): ASSERT (crash in release) @ app.asana.com
​https://bugs.webkit.org/show_bug.cgi?id=98175

Reviewed by Oliver Hunt.

It's bad karma to create a new structure while stealing another structure's property table
while leaving the m_offset unset. Eventually someone will then steal your property table, and
then you won't know how many properties you have anymore.

• runtime/Structure.cpp:

(JSC::Structure::nonPropertyTransition):

File:

• trunk/Source/JavaScriptCore/runtime/Structure.cpp (modified) (1 diff)

trunk/Source/JavaScriptCore/runtime/Structure.cpp

@@ -547 +547 @@
     transition->m_attributesInPrevious = attributes;
     transition->m_indexingType = indexingType;
+    transition->m_offset = structure->m_offset;
     
     if (structure->m_propertyTable) {