| Summary: | REGRESSION (r154253): JSC::PropertySlot::m_attributes is uninitialized in constructor | ||||||
|---|---|---|---|---|---|---|---|
| Product: | WebKit | Reporter: | David Kilzer (:ddkilzer) <ddkilzer> | ||||
| Component: | JavaScriptCore | Assignee: | David Kilzer (:ddkilzer) <ddkilzer> | ||||
| Status: | RESOLVED FIXED | ||||||
| Severity: | Normal | CC: | darin, ews-watchlist, keith_miller, mark.lam, msaboff, saam, tzagallo, webkit-bug-importer | ||||
| Priority: | P2 | Keywords: | InRadar | ||||
| Version: | Other | ||||||
| Hardware: | Unspecified | ||||||
| OS: | Unspecified | ||||||
| Bug Depends on: | 119972 | ||||||
| Bug Blocks: | 212095 | ||||||
| Attachments: |
|
||||||
|
Description
David Kilzer (:ddkilzer)
2020-04-30 17:38:23 PDT
Created attachment 398128 [details]
Patch v1
Comment on attachment 398128 [details] Patch v1 View in context: https://bugs.webkit.org/attachment.cgi?id=398128&action=review r=me > Source/JavaScriptCore/runtime/PropertySlot.h:404 > + } m_additionalData { { 0, 0 } }; Interesting. I never knew that we can do this. Comment on attachment 398128 [details] Patch v1 View in context: https://bugs.webkit.org/attachment.cgi?id=398128&action=review >> Source/JavaScriptCore/runtime/PropertySlot.h:404 >> + } m_additionalData { { 0, 0 } }; > > Interesting. I never knew that we can do this. I think it works because both union types have two instance variables. I guess gcc and MSVC++ will tell us if it's portable, though. Regressed in:
Bug 119972: Add attributes field to PropertySlot
<https://bugs.webkit.org/show_bug.cgi?id=119972>
<https://trac.webkit.org/r154253>
Committed r260993: <https://trac.webkit.org/changeset/260993> All reviewed patches have been landed. Closing bug and clearing flags on attachment 398128 [details]. Comment on attachment 398128 [details] Patch v1 View in context: https://bugs.webkit.org/attachment.cgi?id=398128&action=review >>> Source/JavaScriptCore/runtime/PropertySlot.h:404 >>> + } m_additionalData { { 0, 0 } }; >> >> Interesting. I never knew that we can do this. > > I think it works because both union types have two instance variables. I guess gcc and MSVC++ will tell us if it's portable, though. No, it’s only domAttribute that is initialized. I looked it up: "When a union is initialized by aggregate initialization, only its first non-static data member is initialized." (In reply to Darin Adler from comment #7) > Comment on attachment 398128 [details] > Patch v1 > > View in context: > https://bugs.webkit.org/attachment.cgi?id=398128&action=review > > >>> Source/JavaScriptCore/runtime/PropertySlot.h:404 > >>> + } m_additionalData { { 0, 0 } }; > >> > >> Interesting. I never knew that we can do this. > > > > I think it works because both union types have two instance variables. I guess gcc and MSVC++ will tell us if it's portable, though. > > No, it’s only domAttribute that is initialized. I looked it up: > > "When a union is initialized by aggregate initialization, only its first > non-static data member is initialized." Bug 212095: Make union initializers for JSC::PropertySlot more explicit about which field is being initialized |