From: Apple <opensource@apple.com>
Date: Wed, 10 Dec 2014 17:12:28 +0000 (+0000)
Subject: JavaScriptCore-7600.1.4.13.1.tar.gz
X-Git-Tag: ios-813^0
X-Git-Url: https://git.saurik.com/apple/javascriptcore.git/commitdiff_plain/ef99ff287df9046eb88937225e0554eabb00e33c

JavaScriptCore-7600.1.4.13.1.tar.gz
---

diff --git a/ChangeLog b/ChangeLog
index 35c65f4..bbda15d 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,22 @@
+2014-12-10  Babak Shafiei  <bshafiei@apple.com>
+
+        Merge r176803.
+
+    2014-12-04  Oliver Hunt  <oliver@apple.com>
+
+            Serialization of MapData object provides unsafe access to internal types
+            https://bugs.webkit.org/show_bug.cgi?id=138653
+
+            Reviewed by Geoffrey Garen.
+
+            Converting these ASSERTs into RELEASE_ASSERTs, as it is now obvious
+            that despite trying hard to be safe in all cases it's simply to easy
+            to use an iterator in an unsafe state.
+
+            * runtime/MapData.h:
+            (JSC::MapData::const_iterator::key):
+            (JSC::MapData::const_iterator::value):
+
 2014-09-15  Babak Shafiei  <bshafiei@apple.com>
 
         <rdar://problem/18327341> Disable Web Timing on this branch.
diff --git a/Configurations/Version.xcconfig b/Configurations/Version.xcconfig
index 963f195..84fb2bf 100644
--- a/Configurations/Version.xcconfig
+++ b/Configurations/Version.xcconfig
@@ -24,8 +24,8 @@
 MAJOR_VERSION = 600;
 MINOR_VERSION = 1;
 TINY_VERSION = 4;
-MICRO_VERSION = 11;
-NANO_VERSION = 8;
+MICRO_VERSION = 13;
+NANO_VERSION = 1;
 FULL_VERSION = $(MAJOR_VERSION).$(MINOR_VERSION).$(TINY_VERSION).$(MICRO_VERSION).$(NANO_VERSION);
 
 // The bundle version and short version string are set based on the current build configuration, see below.
diff --git a/runtime/MapData.h b/runtime/MapData.h
index 75b4c6d..9d117db 100644
--- a/runtime/MapData.h
+++ b/runtime/MapData.h
@@ -42,8 +42,8 @@ public:
         const_iterator(const MapData*);
         ~const_iterator();
         const WTF::KeyValuePair<JSValue, JSValue> operator*() const;
-        JSValue key() const { ASSERT(!atEnd()); return m_mapData->m_entries[m_index].key.get(); }
-        JSValue value() const { ASSERT(!atEnd()); return m_mapData->m_entries[m_index].value.get(); }
+        JSValue key() const { RELEASE_ASSERT(!atEnd()); return m_mapData->m_entries[m_index].key.get(); }
+        JSValue value() const { RELEASE_ASSERT(!atEnd()); return m_mapData->m_entries[m_index].value.get(); }
         void operator++() { ASSERT(!atEnd()); internalIncrement(); }
         static const_iterator end(const MapData*);
         bool operator!=(const const_iterator& other);