Revision: 8598
Author: [email protected]
Date: Mon Jul 11 06:36:09 2011
Log: Merge r8596 into 3.2 branch.
Fix bug in Map::TraverseTransitionTree.
If map has an empty DescriptorArray we have to set map_or_index_field to
NULL
otherwise we will
reset iteration state for a previously visited map in the transition tree
which
has a non-empty
DescriptorArray. This might result in visiting the same map several times.
[email protected]
BUG=v8:1526
Review URL: http://codereview.chromium.org/7294026
http://code.google.com/p/v8/source/detail?r=8598
Modified:
/branches/3.2/src/objects.cc
/branches/3.2/src/version.cc
=======================================
--- /branches/3.2/src/objects.cc Fri Jun 3 07:49:11 2011
+++ /branches/3.2/src/objects.cc Mon Jul 11 06:36:09 2011
@@ -3745,6 +3745,8 @@
}
}
if (!map_done) continue;
+ } else {
+ map_or_index_field = NULL;
}
// That was the regular transitions, now for the prototype transitions.
FixedArray* prototype_transitions =
=======================================
--- /branches/3.2/src/version.cc Wed Jul 6 04:14:23 2011
+++ /branches/3.2/src/version.cc Mon Jul 11 06:36:09 2011
@@ -35,7 +35,7 @@
#define MAJOR_VERSION 3
#define MINOR_VERSION 2
#define BUILD_NUMBER 10
-#define PATCH_LEVEL 26
+#define PATCH_LEVEL 27
// Use 1 for candidates and 0 otherwise.
// (Boolean macro values are not supported by all preprocessors.)
#define IS_CANDIDATE_VERSION 0
--
v8-dev mailing list
[email protected]
http://groups.google.com/group/v8-dev
