Reviewers: Erik Corry, Description: Use safe version (i.e. using write barrier) of set_map in ReinitializeJSReceiver.
We pass in the object that we set the map on. Please review this at http://codereview.chromium.org/8486005/ SVN Base: http://v8.googlecode.com/svn/branches/bleeding_edge/ Affected files: M src/heap.cc Index: src/heap.cc =================================================================== --- src/heap.cc (revision 10005) +++ src/heap.cc (working copy) @@ -3846,7 +3846,7 @@ // we must NOT fail after this point, where we have changed the type! // Reset the map for the object. - object->set_map_unsafe(map); + object->set_map(map); JSObject* jsobj = JSObject::cast(object); // Reinitialize the object from the constructor map. -- v8-dev mailing list [email protected] http://groups.google.com/group/v8-dev
