Changeset 226650 in webkit for trunk/Source/JavaScriptCore/parser/Nodes.h

Timestamp:

Jan 9, 2018, 10:49:25 AM (7 years ago)

Author:

[email protected]

Message:

ASSERTION FAILED: pair.second->m_type & PropertyNode::Getter
​https://bugs.webkit.org/show_bug.cgi?id=181388
<rdar://problem/36349351>

Reviewed by Saam Barati.

JSTests:

• stress/regress-181388.js: Added.

Source/JavaScriptCore:

When there are duplicate setters or getters, we may end up overwriting a getter
with a setter, or vice versa. This patch adds tracking for getters/setters that
have been overwritten with duplicates and ignore them.

• bytecompiler/NodesCodegen.cpp:

(JSC::PropertyListNode::emitBytecode):

• parser/NodeConstructors.h:

(JSC::PropertyNode::PropertyNode):

• parser/Nodes.h:

(JSC::PropertyNode::isOverriddenByDuplicate const):
(JSC::PropertyNode::setIsOverriddenByDuplicate):

File:

• trunk/Source/JavaScriptCore/parser/Nodes.h (modified) (3 diffs)

trunk/Source/JavaScriptCore/parser/Nodes.h

@@ -2 +2 @@
  *  Copyright (C) 1999-2000 Harri Porten ([email protected])
  *  Copyright (C) 2001 Peter Kelly ([email protected])
- *  Copyright (C) 2003-2009, 2013, 2015-2016 Apple Inc. All rights reserved.
+ *  Copyright (C) 2003-2018 Apple Inc. All rights reserved.
  *  Copyright (C) 2007 Cameron Zwarich ([email protected])
  *  Copyright (C) 2007 Maks Orlovich
@@ -698 +698 @@
         bool needsSuperBinding() const { return m_needsSuperBinding; }
         bool isClassProperty() const { return m_isClassProperty; }
+        bool isOverriddenByDuplicate() const { return m_isOverriddenByDuplicate; }
+        void setIsOverriddenByDuplicate() { m_isOverriddenByDuplicate = true; }
         PutType putType() const { return static_cast<PutType>(m_putType); }
 
@@ -709 +711 @@
         unsigned m_putType : 1;
         unsigned m_isClassProperty: 1;
+        unsigned m_isOverriddenByDuplicate: 1;
     };