Reviewers: danno,
Message:
PTAL.
Description:
Restore the descriptor array before returning allocation failure.
BUG=crbug:151750
Please review this at https://chromiumcodereview.appspot.com/10989076/
SVN Base: https://v8.googlecode.com/svn/branches/bleeding_edge
Affected files:
M src/objects.cc
Index: src/objects.cc
diff --git a/src/objects.cc b/src/objects.cc
index
f11dfcfab7d17f2183c5fa50d1d348dbc0ccd0bc..e772d54e592a0f6df8d02466750eb490c5d50eea
100644
--- a/src/objects.cc
+++ b/src/objects.cc
@@ -1782,8 +1782,11 @@ MaybeObject*
JSObject::ConvertTransitionToMapTransition(
old_target->SetBackPointer(GetHeap()->undefined_value());
MaybeObject* maybe_failure =
old_target->SetDescriptors(old_descriptors);
- if (maybe_failure->IsFailure()) return maybe_failure;
+ // Reset the backpointer before returning failure, otherwise the map
ends up
+ // with an undefined backpointer and no descriptors, losing its own
+ // descriptors. Setting the backpointer always succeeds.
old_target->SetBackPointer(old_map);
+ if (maybe_failure->IsFailure()) return maybe_failure;
old_map->set_owns_descriptors(true);
}
--
v8-dev mailing list
[email protected]
http://groups.google.com/group/v8-dev
