Reviewers: Toon Verwaest,
Message:
PTAL
Description:
Fix for an assertion failure in Map::FindTransitionToField(...). Appeared
after
r25136.
BUG=chromium:430846
LOG=N
Please review this at https://codereview.chromium.org/704183002/
Base URL: https://v8.googlecode.com/svn/branches/bleeding_edge
Affected files (+10, -13 lines):
M src/objects-inl.h
A + test/mjsunit/regress/regress-crbug-430846.js
Index: src/objects-inl.h
diff --git a/src/objects-inl.h b/src/objects-inl.h
index
85584c43e400f44eabb37ac66f96470efbbb72c2..0288bfb81b7e54558da93d22665009a8c30f7d1e
100644
--- a/src/objects-inl.h
+++ b/src/objects-inl.h
@@ -1886,8 +1886,9 @@ Handle<Map> Map::FindTransitionToField(Handle<Map>
map, Handle<Name> key) {
TransitionArray* transitions = map->transitions();
int transition = transitions->Search(FIELD, *key, NONE);
if (transition == TransitionArray::kNotFound) return Handle<Map>::null();
- DCHECK_EQ(FIELD, transitions->GetTargetDetails(transition).type());
- DCHECK_EQ(NONE, transitions->GetTargetDetails(transition).attributes());
+ PropertyDetails details = transitions->GetTargetDetails(transition);
+ if (details.type() != FIELD) return Handle<Map>::null();
+ DCHECK_EQ(NONE, details.attributes());
return Handle<Map>(transitions->GetTarget(transition));
}
Index: test/mjsunit/regress/regress-crbug-430846.js
diff --git a/test/mjsunit/regress/regress-3392.js
b/test/mjsunit/regress/regress-crbug-430846.js
similarity index 53%
copy from test/mjsunit/regress/regress-3392.js
copy to test/mjsunit/regress/regress-crbug-430846.js
index
375f30210ce11272799c78b51463d97fc6b65998..3047c7fc34202b42f71ee78cd19d6ade0df62349
100644
--- a/test/mjsunit/regress/regress-3392.js
+++ b/test/mjsunit/regress/regress-crbug-430846.js
@@ -4,15 +4,11 @@
// Flags: --allow-natives-syntax
-function foo() {
- var a = {b: -1.5};
- for (var i = 0; i < 1; i++) {
- a.b = 1;
- }
- assertTrue(0 <= a.b);
-}
+function foo() { return 1; };
+var o1 = {};
+o1.foo = foo;
-foo();
-foo();
-%OptimizeFunctionOnNextCall(foo);
-foo();
+var json = '{"foo": {"x": 1}}';
+var o2 = JSON.parse(json);
+var o3 = JSON.parse(json);
+assertTrue(%HaveSameMap(o2, o3));
--
--
v8-dev mailing list
[email protected]
http://groups.google.com/group/v8-dev
---
You received this message because you are subscribed to the Google Groups "v8-dev" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
For more options, visit https://groups.google.com/d/optout.
