Revision: 12629
Author: [email protected]
Date: Fri Sep 28 03:15:58 2012
Log: Restore the descriptor array before returning allocation failure.
BUG=chromium:151750
Review URL: https://chromiumcodereview.appspot.com/10989076
http://code.google.com/p/v8/source/detail?r=12629
Modified:
/branches/bleeding_edge/src/objects.cc
=======================================
--- /branches/bleeding_edge/src/objects.cc Thu Sep 27 06:55:50 2012
+++ /branches/bleeding_edge/src/objects.cc Fri Sep 28 03:15:58 2012
@@ -1782,8 +1782,11 @@
old_target->SetBackPointer(GetHeap()->undefined_value());
MaybeObject* maybe_failure =
old_target->SetDescriptors(old_descriptors);
- if (maybe_failure->IsFailure()) return maybe_failure;
+ // Reset the backpointer before returning failure, otherwise the map
ends up
+ // with an undefined backpointer and no descriptors, losing its own
+ // descriptors. Setting the backpointer always succeeds.
old_target->SetBackPointer(old_map);
+ if (maybe_failure->IsFailure()) return maybe_failure;
old_map->set_owns_descriptors(true);
}
--
v8-dev mailing list
[email protected]
http://groups.google.com/group/v8-dev
