Reviewers: William Hesse,
Description:
Merge r8596 into 3.3 branch.
Fix bug in Map::TraverseTransitionTree.
If map has an empty DescriptorArray we have to set map_or_index_field to
NULL
otherwise we will
reset iteration state for a previously visited map in the transition tree
which
has a non-empty
DescriptorArray. This might result in visiting the same map several times.
[email protected]
BUG=v8:1526
Please review this at http://codereview.chromium.org/7333008/
SVN Base: http://v8.googlecode.com/svn/branches/3.3/
Affected files:
M src/objects.cc
M src/version.cc
Index: src/objects.cc
===================================================================
--- src/objects.cc (revision 8599)
+++ src/objects.cc (working copy)
@@ -3803,6 +3803,8 @@
}
}
if (!map_done) continue;
+ } else {
+ map_or_index_field = NULL;
}
// That was the regular transitions, now for the prototype transitions.
FixedArray* prototype_transitions =
Index: src/version.cc
===================================================================
--- src/version.cc (revision 8599)
+++ src/version.cc (working copy)
@@ -35,7 +35,7 @@
#define MAJOR_VERSION 3
#define MINOR_VERSION 3
#define BUILD_NUMBER 10
-#define PATCH_LEVEL 18
+#define PATCH_LEVEL 19
// Use 1 for candidates and 0 otherwise.
// (Boolean macro values are not supported by all preprocessors.)
#define IS_CANDIDATE_VERSION 0
--
v8-dev mailing list
[email protected]
http://groups.google.com/group/v8-dev
