Indexing should only be computed when the new structure has an indexing header.
[WebKit-https.git] / Source / JavaScriptCore / jit / JITOperations.cpp
index 6a3b16d..fa544d2 100644 (file)
@@ -2311,7 +2311,7 @@ char* JIT_OPERATION operationReallocateButterflyToHavePropertyStorageWithInitial
 
     ASSERT(!object->structure()->outOfLineCapacity());
     Butterfly* result = object->allocateMoreOutOfLineStorage(vm, 0, initialOutOfLineCapacity);
-    object->nukeStructureAndSetButterfly(vm, object->structureID(), result);
+    object->nukeStructureAndSetButterfly(vm, object->structureID(), result, object->indexingType());
     return reinterpret_cast<char*>(result);
 }
 
@@ -2321,7 +2321,7 @@ char* JIT_OPERATION operationReallocateButterflyToGrowPropertyStorage(ExecState*
     NativeCallFrameTracer tracer(&vm, exec);
 
     Butterfly* result = object->allocateMoreOutOfLineStorage(vm, object->structure()->outOfLineCapacity(), newSize);
-    object->nukeStructureAndSetButterfly(vm, object->structureID(), result);
+    object->nukeStructureAndSetButterfly(vm, object->structureID(), result, object->indexingType());
     return reinterpret_cast<char*>(result);
 }