Crash in JSC::Structure::materializePropertyMap when viewing Garden-O-Matic
authorfpizlo@apple.com <fpizlo@apple.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Thu, 27 Oct 2011 22:19:14 +0000 (22:19 +0000)
committerfpizlo@apple.com <fpizlo@apple.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Thu, 27 Oct 2011 22:19:14 +0000 (22:19 +0000)
commit15f05bf1d03db42fa1698b52ac49044732d0ebc9
tree4a268b1573dc018c7b877427beea68809d907697
parente1760cc1765d9c1403ca0a3cd07d5d5263987ad8
Crash in JSC::Structure::materializePropertyMap when viewing Garden-O-Matic
https://bugs.webkit.org/show_bug.cgi?id=71045

Reviewed by Geoff Garen.

Make sure that if a structure is pinned, it also has a property map.

* runtime/Structure.cpp:
(JSC::Structure::changePrototypeTransition):
(JSC::Structure::despecifyFunctionTransition):
(JSC::Structure::getterSetterTransition):
(JSC::Structure::toDictionaryTransition):
(JSC::Structure::preventExtensionsTransition):
(JSC::Structure::addPropertyWithoutTransition):
(JSC::Structure::removePropertyWithoutTransition):
(JSC::Structure::pin):
(JSC::Structure::copyPropertyTableForPinning):
* runtime/Structure.h:
(JSC::Structure::materializePropertyMapIfNecessaryForPinning):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@98647 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Source/JavaScriptCore/ChangeLog
Source/JavaScriptCore/runtime/Structure.cpp
Source/JavaScriptCore/runtime/Structure.h