Changeset 190113 in webkit for trunk/Source/JavaScriptCore/runtime/Structure.cpp

Timestamp:

Sep 22, 2015, 5:21:31 AM (10 years ago)

Author:

[email protected]

Message:

Unreviewed, rolling out r189616.
​https://bugs.webkit.org/show_bug.cgi?id=149456

suspected cause of multiple regressions (Requested by kling on
#webkit).

Reverted changeset:

"[JSC] Weak should only accept cell pointees."
​https://bugs.webkit.org/show_bug.cgi?id=148955
​http://trac.webkit.org/changeset/189616

File:

• trunk/Source/JavaScriptCore/runtime/Structure.cpp (modified) (3 diffs)

trunk/Source/JavaScriptCore/runtime/Structure.cpp

@@ -63 +63 @@
 
 class SingleSlotTransitionWeakOwner final : public WeakHandleOwner {
-    void finalize(JSCell*&, void* context) override
+    void finalize(Handle<Unknown>, void* context) override
     {
         StructureTransitionTable* table = reinterpret_cast<StructureTransitionTable*>(context);
@@ -83 +83 @@
     if (WeakImpl* impl = this->weakImpl()) {
         if (impl->state() == WeakImpl::Live)
-            return jsCast<Structure*>(impl->cell());
+            return jsCast<Structure*>(impl->jsValue().asCell());
     }
     return nullptr;
@@ -93 +93 @@
     if (WeakImpl* impl = this->weakImpl())
         WeakSet::deallocate(impl);
-    WeakImpl* impl = WeakSet::allocate(*structure, &singleSlotTransitionWeakOwner(), this);
+    WeakImpl* impl = WeakSet::allocate(structure, &singleSlotTransitionWeakOwner(), this);
     m_data = reinterpret_cast<intptr_t>(impl) | UsingSingleSlotFlag;
 }