Revision: 8604
Author: [email protected]
Date: Mon Jul 11 07:12:41 2011
Log: Merge r8596 into 3.3 branch.
Fix bug in Map::TraverseTransitionTree.
If map has an empty DescriptorArray we have to set map_or_index_field to
NULL
otherwise we will
reset iteration state for a previously visited map in the transition tree
which
has a non-empty
DescriptorArray. This might result in visiting the same map several times.
[email protected]
BUG=v8:1526
Review URL: http://codereview.chromium.org/7333008
http://code.google.com/p/v8/source/detail?r=8604
Modified:
/branches/3.3/src/objects.cc
/branches/3.3/src/version.cc
=======================================
--- /branches/3.3/src/objects.cc Fri Jun 3 08:46:49 2011
+++ /branches/3.3/src/objects.cc Mon Jul 11 07:12:41 2011
@@ -3803,6 +3803,8 @@
}
}
if (!map_done) continue;
+ } else {
+ map_or_index_field = NULL;
}
// That was the regular transitions, now for the prototype transitions.
FixedArray* prototype_transitions =
=======================================
--- /branches/3.3/src/version.cc Wed Jul 6 04:07:32 2011
+++ /branches/3.3/src/version.cc Mon Jul 11 07:12:41 2011
@@ -35,7 +35,7 @@
#define MAJOR_VERSION 3
#define MINOR_VERSION 3
#define BUILD_NUMBER 10
-#define PATCH_LEVEL 18
+#define PATCH_LEVEL 19
// Use 1 for candidates and 0 otherwise.
// (Boolean macro values are not supported by all preprocessors.)
#define IS_CANDIDATE_VERSION 0
--
v8-dev mailing list
[email protected]
http://groups.google.com/group/v8-dev
