Changeset 48590 in webkit for trunk/JavaScriptCore

Timestamp:

Sep 21, 2009, 11:59:56 AM (16 years ago)

Author:

[email protected]

Message:

REGRESSION (r48582): Crash in StructureStubInfo::initPutByIdTransition when reloading trac.webkit.org
​https://bugs.webkit.org/show_bug.cgi?id=29599

Reviewed by Geoff Garen

It is unsafe to attempt to cache new property transitions on
dictionaries of any type.

Location:

trunk/JavaScriptCore

Files:

• ChangeLog (modified) (1 diff)
• interpreter/Interpreter.cpp (modified) (1 diff)
• jit/JITStubs.cpp (modified) (1 diff)

trunk/JavaScriptCore/ChangeLog

@@ +1 @@
+2009-09-21  Oliver Hunt  <[email protected]>
+
+        Reviewed by Geoff Garen.
+
+        REGRESSION (r48582): Crash in StructureStubInfo::initPutByIdTransition when reloading trac.webkit.org
+        https://bugs.webkit.org/show_bug.cgi?id=29599
+
+        It is unsafe to attempt to cache new property transitions on
+        dictionaries of any type.
+
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::tryCachePutByID):
+        * jit/JITStubs.cpp:
+        (JSC::JITThunks::tryCachePutByID):
+
 2009-09-21  Oliver Hunt  <[email protected]>
 

trunk/JavaScriptCore/interpreter/Interpreter.cpp

@@ -989 +989 @@
     // Structure transition, cache transition info
     if (slot.type() == PutPropertySlot::NewProperty) {
+        if (structure->isDictionary()) {
+            vPC[0] = getOpcode(op_put_by_id_generic);
+            return;
+        }
         vPC[0] = getOpcode(op_put_by_id_transition);
         vPC[4] = structure->previousID();

trunk/JavaScriptCore/jit/JITStubs.cpp

@@ -696 +696 @@
     if (slot.type() == PutPropertySlot::NewProperty) {
         StructureChain* prototypeChain = structure->prototypeChain(callFrame);
-        if (!prototypeChain->isCacheable()) {
+        if (!prototypeChain->isCacheable() || structure->isDictionary()) {
             ctiPatchCallByReturnAddress(codeBlock, returnAddress, FunctionPtr(cti_op_put_by_id_generic));
             return;