Reviewers: Toon Verwaest,
Message:
Committed patchset #1 (id:1) manually as
b696572d4ffcbaed88ad31b948228385e874becb (tree was closed).
Description:
Fixed incorrect generalization of types in Map::ReconfigureProperty()
introduced
in r26667.
BUG=chromium:459512
LOG=N
[email protected]
Committed:
https://chromium.googlesource.com/v8/v8/+/b696572d4ffcbaed88ad31b948228385e874becb
Please review this at https://codereview.chromium.org/936253002/
Base URL: https://chromium.googlesource.com/v8/v8.git@master
Affected files (+2, -2 lines):
M src/objects.cc
Index: src/objects.cc
diff --git a/src/objects.cc b/src/objects.cc
index
fd35c90e8d39049b7a5153339c697d84d90e6ca3..1842bb60ef050d5595f7441bb91b6e9b163c21a6
100644
--- a/src/objects.cc
+++ b/src/objects.cc
@@ -2815,8 +2815,8 @@ Handle<Map> Map::ReconfigureProperty(Handle<Map>
old_map, int modify_index,
Handle<HeapType> old_field_type =
GetFieldType(isolate, old_descriptors, i,
old_details.location(), next_representation);
- old_field_type =
- GeneralizeFieldType(old_field_type, next_field_type,
isolate);
+ next_field_type =
+ GeneralizeFieldType(next_field_type, old_field_type,
isolate);
}
} else {
Handle<HeapType> old_field_type =
--
--
v8-dev mailing list
[email protected]
http://groups.google.com/group/v8-dev
---
You received this message because you are subscribed to the Google Groups "v8-dev" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
For more options, visit https://groups.google.com/d/optout.
