Fix assertion in JSObject's structure setting methods
authorkeith_miller@apple.com <keith_miller@apple.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Thu, 14 Dec 2017 22:28:09 +0000 (22:28 +0000)
committerkeith_miller@apple.com <keith_miller@apple.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Thu, 14 Dec 2017 22:28:09 +0000 (22:28 +0000)
commit626f2e7f772b18264a1dd6fc04ff97de4cdd49f8
treecbf296256b8b212486346e4acb12c840236d203f
parentfdbec9ef535434a43b9629a529e61cdd3e634124
Fix assertion in JSObject's structure setting methods
https://bugs.webkit.org/show_bug.cgi?id=180840

Reviewed by Mark Lam.

I forgot that when Typed Arrays have non-indexed properties
added to them, they call the generic code. The generic code
in turn calls the regular structure setting methods. Thus,
these assertions were invalid and we should just avoid setting
the indexing mask if we have a Typed Array.

* runtime/JSObject.h:
(JSC::JSObject::setButterfly):
(JSC::JSObject::nukeStructureAndSetButterfly):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@225933 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Source/JavaScriptCore/ChangeLog
Source/JavaScriptCore/runtime/JSObject.h