Changeset 47474 in webkit for trunk/JavaScriptCore/runtime

Timestamp:

Aug 18, 2009, 7:19:10 PM (16 years ago)

Author:

[email protected]

Message:

Assigning a function to an object should always use the existing transition, even if the transition is not specialized
​https://bugs.webkit.org/show_bug.cgi?id=28442

Reviewed by Gavin Barraclough.

Check for an unspecialized transition as an alternative to always failing if specialisation does not match.

File:

• trunk/JavaScriptCore/runtime/Structure.cpp (modified) (1 diff)

trunk/JavaScriptCore/runtime/Structure.cpp

@@ -386 +386 @@
         if (existingTransition && existingTransition->m_nameInPrevious.get() == propertyName.ustring().rep()
             && existingTransition->m_attributesInPrevious == attributes
-            && existingTransition->m_specificValueInPrevious == specificValue) {
+            && (existingTransition->m_specificValueInPrevious == specificValue || existingTransition->m_specificValueInPrevious == 0)) {
 
             ASSERT(structure->m_transitions.singleTransition->m_offset != noOffset);