https://bugs.webkit.org/show_bug.cgi?id=174355
* ftl/FTLLowerDFGToB3.cpp:
(JSC::FTL::DFG::LowerDFGToB3::compileGetMapBucketNext):
git-svn-id: https://svn.webkit.org/repository/webkit/trunk@221113
268f45cc-cd09-0410-ab3c-
d52691b4dbfc
+2017-08-23 Yusuke Suzuki <utatane.tea@gmail.com>
+
+ Unreviewed, debug build fix
+ https://bugs.webkit.org/show_bug.cgi?id=174355
+
+ * ftl/FTLLowerDFGToB3.cpp:
+ (JSC::FTL::DFG::LowerDFGToB3::compileGetMapBucketNext):
+
2017-08-23 Michael Saboff <msaboff@apple.com>
REGRESSION (r221052): DumpRenderTree crashed in com.apple.JavaScriptCore: JSC::Yarr::YarrCodeBlock::execute + 137
if (m_node->bucketOwnerType() == BucketOwnerType::Map)
noBucketResult = m_out.anchor(weakPointer(vm().sentinelMapBucket.get()));
else {
- ASSERT(node->bucketOwnerType() == BucketOwnerType::Set);
+ ASSERT(m_node->bucketOwnerType() == BucketOwnerType::Set);
noBucketResult = m_out.anchor(weakPointer(vm().sentinelSetBucket.get()));
}
m_out.jump(continuation);