Changeset 174749 in webkit for trunk/Source/JavaScriptCore/dfg

Timestamp:

Oct 15, 2014, 5:14:28 PM (11 years ago)

Author:

[email protected]

Message:

REGRESSION(r174025): remote inspector crashes frequently when executing inspector frontend's JavaScript
​https://bugs.webkit.org/show_bug.cgi?id=137758

Rubber stamped by Filip Pizlo.

Reverted r174025 for just PutByOffset Nodes.

• dfg/DFGFixupPhase.cpp:

(JSC::DFG::FixupPhase::fixupNode):

File:

• trunk/Source/JavaScriptCore/dfg/DFGFixupPhase.cpp (modified) (1 diff)

trunk/Source/JavaScriptCore/dfg/DFGFixupPhase.cpp

@@ -944 +944 @@
                 fixEdge<KnownCellUse>(node->child1());
             fixEdge<KnownCellUse>(node->child2());
-            insertStoreBarrier(m_indexInBlock, node->child2(), node->child3());
+            insertStoreBarrier(m_indexInBlock, node->child2());
             break;
         }