Revision: 22707
Author: [email protected]
Date: Wed Jul 30 12:44:50 2014 UTC
Log: Fix
BUG=
[email protected]
Review URL: https://codereview.chromium.org/431483003
http://code.google.com/p/v8/source/detail?r=22707
Modified:
/branches/bleeding_edge/src/arm64/stub-cache-arm64.cc
/branches/bleeding_edge/src/stub-cache.cc
=======================================
--- /branches/bleeding_edge/src/arm64/stub-cache-arm64.cc Wed Jul 30
12:21:41 2014 UTC
+++ /branches/bleeding_edge/src/arm64/stub-cache-arm64.cc Wed Jul 30
12:44:50 2014 UTC
@@ -831,7 +831,7 @@
ASSERT(!AreAliased(reg, scratch2, scratch3, dictionary));
if (!holder()->HasFastProperties()) {
- ASSERT(holder()->IsGlobalObject());
+ ASSERT(!holder()->IsGlobalObject());
// Load the properties dictionary.
__ Ldr(dictionary, FieldMemOperand(reg, JSObject::kPropertiesOffset));
=======================================
--- /branches/bleeding_edge/src/stub-cache.cc Wed Jul 30 12:21:41 2014 UTC
+++ /branches/bleeding_edge/src/stub-cache.cc Wed Jul 30 12:44:50 2014 UTC
@@ -969,11 +969,11 @@
// Find the top object.
Handle<JSObject> last;
PrototypeIterator iter(isolate(), holder());
- do {
+ while (!iter.IsAtEnd()) {
last = Handle<JSObject>::cast(PrototypeIterator::GetCurrent(iter));
iter.Advance();
- } while (!iter.IsAtEnd());
- set_holder(last);
+ }
+ if (!last.is_null()) set_holder(last);
}
Register holder_reg = FrontendHeader(receiver(), name, &miss);
--
--
v8-dev mailing list
[email protected]
http://groups.google.com/group/v8-dev
---
You received this message because you are subscribed to the Google Groups "v8-dev" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
For more options, visit https://groups.google.com/d/optout.
