Revision: 10007
Author: [email protected]
Date: Wed Nov 16 02:40:50 2011
Log: Use safe version (i.e. using write barrier) of set_map in
ReinitializeJSReceiver.
We pass in the object that we set the map on.
Review URL: http://codereview.chromium.org/8486005
http://code.google.com/p/v8/source/detail?r=10007
Modified:
/branches/bleeding_edge/src/heap.cc
=======================================
--- /branches/bleeding_edge/src/heap.cc Tue Nov 15 06:01:02 2011
+++ /branches/bleeding_edge/src/heap.cc Wed Nov 16 02:40:50 2011
@@ -3846,7 +3846,7 @@
// we must NOT fail after this point, where we have changed the type!
// Reset the map for the object.
- object->set_map_unsafe(map);
+ object->set_map(map);
JSObject* jsobj = JSObject::cast(object);
// Reinitialize the object from the constructor map.
--
v8-dev mailing list
[email protected]
http://groups.google.com/group/v8-dev
