Attachment 369496 Details for Bug 197740 – Patch

[patch] Patch

bug-197740-20190509103503.patch (text/plain), 1.82 KB, created by Keith Miller on 2019-05-09 10:35:05 PDT

(hide)

Description:

Filename:

MIME Type:

Creator: Keith Miller

Created: 2019-05-09 10:35:05 PDT

Size: 1.82 KB

patch

obsolete

>Subversion Revision: 245075
>diff --git a/Source/JavaScriptCore/ChangeLog b/Source/JavaScriptCore/ChangeLog
>index 0e86c5928483859b5ae927a9dc87a943bb91446c..c657d2d0ceed14c66cdc374dd0c669a005e22c3f 100644
>--- a/Source/JavaScriptCore/ChangeLog
>+++ b/Source/JavaScriptCore/ChangeLog
>@@ -1,3 +1,13 @@
>+2019-05-09  Keith Miller  <keith_miller@apple.com>
>+
>+        REGRESSION (r245064): ASSERTION FAILED: m_ptr seen with wasm.yaml/wasm/js-api/test_Data.js.wasm-slow-memory
>+        https://bugs.webkit.org/show_bug.cgi?id=197740
>+
>+        Reviewed by NOBODY (OOPS!).
>+
>+        * runtime/JSArrayBufferView.h:
>+        (JSC::JSArrayBufferView::ConstructionContext::vector const):
>+
> 2019-05-08  Yusuke Suzuki  <ysuzuki@apple.com>
> 
>         Invalid DFG JIT genereation in high CPU usage state
>diff --git a/Source/JavaScriptCore/runtime/JSArrayBufferView.h b/Source/JavaScriptCore/runtime/JSArrayBufferView.h
>index 35ce36c5a381ee08fd7e2784ea046199d98239e5..4dfd08f2593f9d54df011b3c81278c594b1e3d03 100644
>--- a/Source/JavaScriptCore/runtime/JSArrayBufferView.h
>+++ b/Source/JavaScriptCore/runtime/JSArrayBufferView.h
>@@ -1,5 +1,5 @@
> /*
>- * Copyright (C) 2013, 2016 Apple Inc. All rights reserved.
>+ * Copyright (C) 2013-2019 Apple Inc. All rights reserved.
>  *
>  * Redistribution and use in source and binary forms, with or without
>  * modification, are permitted provided that the following conditions
>@@ -135,7 +135,7 @@ protected:
>         bool operator!() const { return !m_structure; }
>         
>         Structure* structure() const { return m_structure; }
>-        void* vector() const { return m_vector.get(m_length); }
>+        void* vector() const { return m_vector.getMayBeNull(m_length); }
>         uint32_t length() const { return m_length; }
>         TypedArrayMode mode() const { return m_mode; }
>         Butterfly* butterfly() const { return m_butterfly; }

Flags:

saam: review+

Actions: View | Formatted Diff | Diff

Attachments on bug 197740: 369496