Changeset 44797 in webkit for trunk/JavaScriptCore/jit/JIT.h

Timestamp:

Jun 17, 2009, 11:40:53 PM (16 years ago)

Author:

[email protected]

Message:

<rdar://problem/6974140> REGRESSION(r43849): Crash in cti_op_call_NotJSFunction when getting directions on maps.google.com

Reviewed by Gavin Barraclough

Roll out r43849 as it appears that we cannot rely on the address of
an objects property storage being constant even if the structure is
unchanged.

File:

• trunk/JavaScriptCore/jit/JIT.h (modified) (1 diff)

trunk/JavaScriptCore/jit/JIT.h

@@ -460 +460 @@
 
         void compileGetDirectOffset(RegisterID base, RegisterID result, Structure* structure, size_t cachedOffset);
-        void compileGetDirectOffset(JSObject* base, RegisterID result, size_t cachedOffset);
+        void compileGetDirectOffset(JSObject* base, RegisterID temp, RegisterID result, size_t cachedOffset);
         void compilePutDirectOffset(RegisterID base, RegisterID value, Structure* structure, size_t cachedOffset);