diff options
| author | Oliver Hunt <oliver@apple.com> | 2013-04-16 11:58:22 +0200 |
|---|---|---|
| committer | The Qt Project <gerrit-noreply@qt-project.org> | 2013-04-16 19:58:28 +0200 |
| commit | 9e5eaab34ec9fe2a0e0ba169c939a23bef8df900 (patch) | |
| tree | c7e86fb61424307eb0d3468f0d47795737305c3e /Source/JavaScriptCore/runtime/JSObject.h | |
| parent | e6f5f9638bf32baf3312e5c2e06f817bbcfc8ca1 (diff) | |
| download | qtwebkit-9e5eaab34ec9fe2a0e0ba169c939a23bef8df900.tar.gz | |
Add more assertions to the property storage use in arrays
https://bugs.webkit.org/show_bug.cgi?id=107728
Reviewed by Filip Pizlo.
Add a bunch of assertions to array and object butterfly
usage. This should make debugging somewhat easier.
I also converted a couple of assertions to release asserts
as they were so low cost it seemed a sensible thing to do.
* runtime/JSArray.cpp:
(JSC::JSArray::sortVector):
(JSC::JSArray::compactForSorting):
* runtime/JSObject.h:
(JSC::JSObject::getHolyIndexQuickly):
Change-Id: Ie6164b837e7671b87c003de3e29fd33ef05f4362
git-svn-id: http://svn.webkit.org/repository/webkit/trunk@141029 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Reviewed-by: Jocelyn Turcotte <jocelyn.turcotte@digia.com>
Diffstat (limited to 'Source/JavaScriptCore/runtime/JSObject.h')
| -rw-r--r-- | Source/JavaScriptCore/runtime/JSObject.h | 1 |
1 files changed, 1 insertions, 0 deletions
diff --git a/Source/JavaScriptCore/runtime/JSObject.h b/Source/JavaScriptCore/runtime/JSObject.h index 957ba8227..428e51f3c 100644 --- a/Source/JavaScriptCore/runtime/JSObject.h +++ b/Source/JavaScriptCore/runtime/JSObject.h @@ -862,6 +862,7 @@ protected: JSValue getHolyIndexQuickly(unsigned i) { + ASSERT(i < m_butterfly->vectorLength()); switch (structure()->indexingType()) { case ALL_INT32_INDEXING_TYPES: case ALL_CONTIGUOUS_INDEXING_TYPES: |