2011-04-06 Oliver Hunt <oliver@apple.com>

        Reviewed by Gavin Barraclough.

        Stop JSObject::isUsingInlineStorage() from using the structure
        https://bugs.webkit.org/show_bug.cgi?id=57986

        Make the isUsingInlineStorage() implementation just look at
        whether the property storage is inside the object.

        * runtime/JSObject.h:
        (JSC::JSObject::isUsingInlineStorage):
        (JSC::JSObject::JSObject):

git-svn-id: svn://svn.chromium.org/blink/trunk@83107 bbb929c8-8fbe-4397-9dbb-9b2b20218538

third_party/WebKit/Source/JavaScriptCore/ChangeLog

+2011-04-06  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        Stop JSObject::isUsingInlineStorage() from using the structure
+        https://bugs.webkit.org/show_bug.cgi?id=57986
+
+        Make the isUsingInlineStorage() implementation just look at
+        whether the property storage is inside the object.
+
+        * runtime/JSObject.h:
+        (JSC::JSObject::isUsingInlineStorage):
+        (JSC::JSObject::JSObject):
+
 2011-04-06  Gavin Barraclough  <barraclough@apple.com>
 
         Rubber stamped by Geoff Garen.

third_party/WebKit/Source/JavaScriptCore/runtime/JSObject.h

@@ -220,7 +220,7 @@ namespace JSC {
         virtual ComplType exceptionType() const { return Throw; }
 
         void allocatePropertyStorage(size_t oldSize, size_t newSize);
-        bool isUsingInlineStorage() const { return m_structure->isUsingInlineStorage(); }
+        bool isUsingInlineStorage() const { return static_cast<const void*>(m_propertyStorage) == static_cast<const void*>(this + 1); }
 
         static const unsigned baseExternalStorageCapacity = 16;
 
@@ -401,6 +401,7 @@ inline JSObject::JSObject(NonNullPassRefPtr<Structure> structure, PropertyStorag
     ASSERT(m_structure->propertyStorageCapacity() < baseExternalStorageCapacity);
     ASSERT(m_structure->isEmpty());
     ASSERT(prototype().isNull() || Heap::heap(this) == Heap::heap(prototype()));
+    ASSERT(static_cast<void*>(inlineStorage) == static_cast<void*>(this + 1));
 }
 
 inline JSObject::~JSObject()