Reviewers: Mads Ager, Message: Two issues with this fix: 1) The bug is only reproducible with the submitted reduction. I could not create a reduction that reproduced it. The submitted reduction comes from a contributor, derived from a commercial product. Therefore, maybe we don't need the regression test. 2) The bug was not caught more easily because using -1 for the "not found" index from HashTable and Dictionary lookups does not trigger the asserts that using -10 or -100 would, since FixedArray::get() is called with a valid index by lookups of -1 in a HashTable, because of the HashTable header. If we changed -1 to kInvalidIndex = -100, it would be more stable, but this is a bigger change.
Description: Fix issue 386, a bug in JSObject::ReplaceSlowProperty with constant transitions. Please review this at http://codereview.chromium.org/141031 SVN Base: http://v8.googlecode.com/svn/branches/bleeding_edge/ Affected files: M src/objects.h M src/objects.cc A test/mjsunit/regress/regress-386.js --~--~---------~--~----~------------~-------~--~----~ v8-dev mailing list [email protected] http://groups.google.com/group/v8-dev -~----------~----~----~----~------~----~------~--~---
