Changeset 48590 in webkit for trunk/JavaScriptCore/interpreter/Interpreter.cpp

Timestamp:

Sep 21, 2009, 11:59:56 AM (16 years ago)

Author:

[email protected]

Message:

REGRESSION (r48582): Crash in StructureStubInfo::initPutByIdTransition when reloading trac.webkit.org
​https://bugs.webkit.org/show_bug.cgi?id=29599

Reviewed by Geoff Garen

It is unsafe to attempt to cache new property transitions on
dictionaries of any type.

File:

• trunk/JavaScriptCore/interpreter/Interpreter.cpp (modified) (1 diff)

trunk/JavaScriptCore/interpreter/Interpreter.cpp

@@ -989 +989 @@
     // Structure transition, cache transition info
     if (slot.type() == PutPropertySlot::NewProperty) {
+        if (structure->isDictionary()) {
+            vPC[0] = getOpcode(op_put_by_id_generic);
+            return;
+        }
         vPC[0] = getOpcode(op_put_by_id_transition);
         vPC[4] = structure->previousID();