REGRESSION (r208711-r208722): ASSERTION FAILED: hasInlineStorage()
authorfpizlo@apple.com <fpizlo@apple.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Tue, 15 Nov 2016 17:32:53 +0000 (17:32 +0000)
committerfpizlo@apple.com <fpizlo@apple.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Tue, 15 Nov 2016 17:32:53 +0000 (17:32 +0000)
commit771ec59e230054f90a7eb924b8898c0c1285131b
tree70c8061610b4907a8d55ff9d1d6eddf06adef8f2
parent1512e2f9334a86fdd628e3a8081a8d1aafd5e310
REGRESSION (r208711-r208722): ASSERTION FAILED: hasInlineStorage()
https://bugs.webkit.org/show_bug.cgi?id=164775

Reviewed by Mark Lam and Keith Miller.

We were calling inlineStorage() which asserts that inline storage is not empty. But we
were calling it in a context where it could be empty and that's fine. So, we now call
inlineStorageUnsafe().

* runtime/JSObject.h:
(JSC::JSFinalObject::JSFinalObject):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@208734 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Source/JavaScriptCore/ChangeLog
Source/JavaScriptCore/runtime/JSObject.h