I'd be happy to review this, but I don't understand how it's supposed to
work
when a hash allocation fails on lookup? E.g., if I add this code to the
provided
test
for (int i = 0; i < 100000; i++) {
Handle<JSObject> o = FACTORY->NewJSArray(100);
dict->FindEntry(*o);
}
it triggers the assert below
4365 uint32_t ObjectDictionaryShape::Hash(JSObject* key) {
4366 MaybeObject* maybe_hash = key->GetIdentityHash();
4367 ASSERT(!maybe_hash->IsFailure());
4368 return Smi::cast(maybe_hash->ToObjectUnchecked())->value();
4369 }
http://codereview.chromium.org/7385006/
--
v8-dev mailing list
[email protected]
http://groups.google.com/group/v8-dev
