REGRESSION (r245064): ASSERTION FAILED: m_ptr seen with wasm.yaml/wasm/js-api/test_Data.js.wasm-slow-memory
https://bugs.webkit.org/show_bug.cgi?id=197740
Reviewed by Saam Barati.
If a TypedArray constructor is called with just 0 as the first argument, we don't allocate a backing vector.
This means we need to handle null when calling vector() in ConstructionContext.
* runtime/JSArrayBufferView.h:
(JSC::JSArrayBufferView::ConstructionContext::vector const):
git-svn-id: http://svn.webkit.org/repository/webkit/trunk@245145 268f45cc-cd09-0410-ab3c-d52691b4dbfc
diff --git a/Source/JavaScriptCore/ChangeLog b/Source/JavaScriptCore/ChangeLog
index 6caacc0..211b315 100644
--- a/Source/JavaScriptCore/ChangeLog
+++ b/Source/JavaScriptCore/ChangeLog
@@ -1,3 +1,16 @@
+2019-05-09 Keith Miller <keith_miller@apple.com>
+
+ REGRESSION (r245064): ASSERTION FAILED: m_ptr seen with wasm.yaml/wasm/js-api/test_Data.js.wasm-slow-memory
+ https://bugs.webkit.org/show_bug.cgi?id=197740
+
+ Reviewed by Saam Barati.
+
+ If a TypedArray constructor is called with just 0 as the first argument, we don't allocate a backing vector.
+ This means we need to handle null when calling vector() in ConstructionContext.
+
+ * runtime/JSArrayBufferView.h:
+ (JSC::JSArrayBufferView::ConstructionContext::vector const):
+
2019-05-09 Xan López <xan@igalia.com>
[CMake] Detect SSE2 at compile time
diff --git a/Source/JavaScriptCore/runtime/JSArrayBufferView.h b/Source/JavaScriptCore/runtime/JSArrayBufferView.h
index 35ce36c..4dfd08f 100644
--- a/Source/JavaScriptCore/runtime/JSArrayBufferView.h
+++ b/Source/JavaScriptCore/runtime/JSArrayBufferView.h
@@ -1,5 +1,5 @@
/*
- * Copyright (C) 2013, 2016 Apple Inc. All rights reserved.
+ * Copyright (C) 2013-2019 Apple Inc. All rights reserved.
*
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions
@@ -135,7 +135,7 @@
bool operator!() const { return !m_structure; }
Structure* structure() const { return m_structure; }
- void* vector() const { return m_vector.get(m_length); }
+ void* vector() const { return m_vector.getMayBeNull(m_length); }
uint32_t length() const { return m_length; }
TypedArrayMode mode() const { return m_mode; }
Butterfly* butterfly() const { return m_butterfly; }
