Changeset 48590 in webkit for trunk/JavaScriptCore/ChangeLog

Timestamp:

Sep 21, 2009, 11:59:56 AM (16 years ago)

Author:

[email protected]

Message:

REGRESSION (r48582): Crash in StructureStubInfo::initPutByIdTransition when reloading trac.webkit.org
​https://bugs.webkit.org/show_bug.cgi?id=29599

Reviewed by Geoff Garen

It is unsafe to attempt to cache new property transitions on
dictionaries of any type.

File:

• trunk/JavaScriptCore/ChangeLog (modified) (1 diff)

trunk/JavaScriptCore/ChangeLog

@@ +1 @@
+2009-09-21  Oliver Hunt  <[email protected]>
+
+        Reviewed by Geoff Garen.
+
+        REGRESSION (r48582): Crash in StructureStubInfo::initPutByIdTransition when reloading trac.webkit.org
+        https://bugs.webkit.org/show_bug.cgi?id=29599
+
+        It is unsafe to attempt to cache new property transitions on
+        dictionaries of any type.
+
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::tryCachePutByID):
+        * jit/JITStubs.cpp:
+        (JSC::JITThunks::tryCachePutByID):
+
 2009-09-21  Oliver Hunt  <[email protected]>