Changeset 48590 in webkit for trunk/JavaScriptCore/jit/JITStubs.cpp

Timestamp:

Sep 21, 2009, 11:59:56 AM (16 years ago)

Author:

[email protected]

Message:

REGRESSION (r48582): Crash in StructureStubInfo::initPutByIdTransition when reloading trac.webkit.org
​https://bugs.webkit.org/show_bug.cgi?id=29599

Reviewed by Geoff Garen

It is unsafe to attempt to cache new property transitions on
dictionaries of any type.

File:

• trunk/JavaScriptCore/jit/JITStubs.cpp (modified) (1 diff)

trunk/JavaScriptCore/jit/JITStubs.cpp

@@ -696 +696 @@
     if (slot.type() == PutPropertySlot::NewProperty) {
         StructureChain* prototypeChain = structure->prototypeChain(callFrame);
-        if (!prototypeChain->isCacheable()) {
+        if (!prototypeChain->isCacheable() || structure->isDictionary()) {
             ctiPatchCallByReturnAddress(codeBlock, returnAddress, FunctionPtr(cti_op_put_by_id_generic));
             return;