Changeset 154407 in webkit for trunk/Source/JavaScriptCore/heap

Timestamp:

Aug 21, 2013, 1:31:02 PM (12 years ago)

Author:

[email protected]

Message:

Remove incorrect ASSERT from CopyVisitor::visitItem

Rubber stamped by Filip Pizlo.

Source/JavaScriptCore:

• heap/CopyVisitorInlines.h:

(JSC::CopyVisitor::visitItem):

LayoutTests:

Added a new test that triggered the old ASSERT. It's a useful test to have because we create
TypedArrays with custom properties.

• fast/js/regress/ArrayBuffer-Int8Array-alloc-large-long-lived-fragmented-expected.txt: Added.
• fast/js/regress/ArrayBuffer-Int8Array-alloc-large-long-lived-fragmented.html: Added.
• fast/js/regress/script-tests/ArrayBuffer-Int8Array-alloc-large-long-lived-fragmented.js: Added.

File:

• trunk/Source/JavaScriptCore/heap/CopyVisitorInlines.h (modified) (1 diff)

trunk/Source/JavaScriptCore/heap/CopyVisitorInlines.h

@@ -38 +38 @@
 {
     if (item.token() == ButterflyCopyToken) {
-        ASSERT(item.cell()->structure()->classInfo()->methodTable.copyBackingStore == JSObject::copyBackingStore);
         JSObject::copyBackingStore(item.cell(), *this, ButterflyCopyToken);
         return;