Unreviewed, debug build fix

https://bugs.webkit.org/show_bug.cgi?id=174355

* ftl/FTLLowerDFGToB3.cpp:
(JSC::FTL::DFG::LowerDFGToB3::compileGetMapBucketNext):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@221113 268f45cc-cd09-0410-ab3c-d52691b4dbfc

diff --git a/Source/JavaScriptCore/ChangeLog b/Source/JavaScriptCore/ChangeLog
index 23d9c9f..1c7a44b 100644 (file)
--- a/Source/JavaScriptCore/ChangeLog
+++ b/Source/JavaScriptCore/ChangeLog
@@ -1,3 +1,11 @@
+2017-08-23  Yusuke Suzuki  <utatane.tea@gmail.com>
+
+        Unreviewed, debug build fix
+        https://bugs.webkit.org/show_bug.cgi?id=174355
+
+        * ftl/FTLLowerDFGToB3.cpp:
+        (JSC::FTL::DFG::LowerDFGToB3::compileGetMapBucketNext):
+
 2017-08-23  Michael Saboff  <msaboff@apple.com>
 
         REGRESSION (r221052): DumpRenderTree crashed in com.apple.JavaScriptCore: JSC::Yarr::YarrCodeBlock::execute + 137

diff --git a/Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp b/Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp
index 6335a0b..dab9562 100644 (file)
--- a/Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp
+++ b/Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp
@@ -8294,7 +8294,7 @@ private:
         if (m_node->bucketOwnerType() == BucketOwnerType::Map)
             noBucketResult = m_out.anchor(weakPointer(vm().sentinelMapBucket.get()));
         else {
-            ASSERT(node->bucketOwnerType() == BucketOwnerType::Set);
+            ASSERT(m_node->bucketOwnerType() == BucketOwnerType::Set);
             noBucketResult = m_out.anchor(weakPointer(vm().sentinelSetBucket.get()));
         }
         m_out.jump(continuation);