2011-05-26 Geoffrey Garen <ggaren@apple.com>

        Reviewed by Oliver Hunt.

        Provide a real owner when copying a property table, for the sake of
        write barriers.
        https://bugs.webkit.org/show_bug.cgi?id=61547

        No test because we can't enable the writeBarrier() ASSERT just yet.

        * runtime/Structure.cpp:
        (JSC::Structure::addPropertyTransition):

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@87406 268f45cc-cd09-0410-ab3c-d52691b4dbfc

diff --git a/Source/JavaScriptCore/ChangeLog b/Source/JavaScriptCore/ChangeLog
index 32b2707..d348909 100644 (file)
--- a/Source/JavaScriptCore/ChangeLog
+++ b/Source/JavaScriptCore/ChangeLog
@@ -1,3 +1,16 @@
+2011-05-26  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Provide a real owner when copying a property table, for the sake of
+        write barriers.
+        https://bugs.webkit.org/show_bug.cgi?id=61547
+        
+        No test because we can't enable the writeBarrier() ASSERT just yet.
+
+        * runtime/Structure.cpp:
+        (JSC::Structure::addPropertyTransition):
+
 2011-05-26  Adam Roben  <aroben@apple.com>
 
         Windows build fix after r87346

diff --git a/Source/JavaScriptCore/runtime/Structure.cpp b/Source/JavaScriptCore/runtime/Structure.cpp
index a3fda54..2788844 100644 (file)
--- a/Source/JavaScriptCore/runtime/Structure.cpp
+++ b/Source/JavaScriptCore/runtime/Structure.cpp
@@ -366,7 +366,7 @@ Structure* Structure::addPropertyTransition(JSGlobalData& globalData, Structure*
 
     if (structure->m_propertyTable) {
         if (structure->m_isPinnedPropertyTable)
-            transition->m_propertyTable = structure->m_propertyTable->copy(globalData, 0, structure->m_propertyTable->size() + 1);
+            transition->m_propertyTable = structure->m_propertyTable->copy(globalData, transition, structure->m_propertyTable->size() + 1);
         else
             transition->m_propertyTable = structure->m_propertyTable.release();
     } else {