Add some more register state information when we crash in repatchPutById
authorsbarati@apple.com <sbarati@apple.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Thu, 28 Jun 2018 00:18:50 +0000 (00:18 +0000)
committersbarati@apple.com <sbarati@apple.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Thu, 28 Jun 2018 00:18:50 +0000 (00:18 +0000)
https://bugs.webkit.org/show_bug.cgi?id=187112

Reviewed by Mark Lam.

This will help us gather info when we end up seeing a ObjectPropertyConditionSet
with an offset that is different than what the put tells us.

* jit/Repatch.cpp:
(JSC::tryCachePutByID):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@233291 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Source/JavaScriptCore/ChangeLog
Source/JavaScriptCore/jit/Repatch.cpp

index ecf4246..1bf14b5 100644 (file)
@@ -1,3 +1,16 @@
+2018-06-27  Saam Barati  <sbarati@apple.com>
+
+        Add some more register state information when we crash in repatchPutById
+        https://bugs.webkit.org/show_bug.cgi?id=187112
+
+        Reviewed by Mark Lam.
+
+        This will help us gather info when we end up seeing a ObjectPropertyConditionSet
+        with an offset that is different than what the put tells us.
+
+        * jit/Repatch.cpp:
+        (JSC::tryCachePutByID):
+
 2018-06-27  Mark Lam  <mark.lam@apple.com>
 
         Fix a bug in $vm.callFrame() and apply previously requested renaming of $vm.println to print.
index dd6c254..6448fdf 100644 (file)
@@ -573,7 +573,9 @@ static InlineCacheAction tryCachePutByID(ExecState* exec, JSValue baseValue, Str
                         if (!conditionSet.isValid())
                             return GiveUpOnCache;
 
-                        RELEASE_ASSERT(offset == conditionSet.slotBaseCondition().offset());
+                        PropertyOffset conditionSetOffset = conditionSet.slotBaseCondition().offset();
+                        if (UNLIKELY(offset != conditionSetOffset))
+                            CRASH_WITH_INFO(offset, conditionSetOffset, slot.base()->type(), baseCell->type(), conditionSet.size());
                     }
 
                 }