Reviewers: ulan,
Message:
PTAL
Description:
Lookup transition again after migrating a transition target.
[email protected]
BUG=chromium:242332
Please review this at https://chromiumcodereview.appspot.com/16347005/
SVN Base: https://v8.googlecode.com/svn/branches/bleeding_edge
Affected files:
M src/ic.cc
Index: src/ic.cc
diff --git a/src/ic.cc b/src/ic.cc
index
ef8ab8a309eb3a4e5bb067f3cf2419b3629f05c4..db1cb956edc75f64fdf6249ef0c25fe1e8f20bdc
100644
--- a/src/ic.cc
+++ b/src/ic.cc
@@ -1541,6 +1541,10 @@ static bool LookupForWrite(Handle<JSObject> receiver,
Handle<Map> target(lookup->GetTransitionMapFromMap(receiver->map()));
Map::GeneralizeRepresentation(
target, target->LastAdded(), value->OptimalRepresentation());
+ // Lookup the transition again since the transition tree may have
changed
+ // entirely by the migration above.
+ receiver->map()->LookupTransition(*holder, *name, lookup);
+ if (!lookup->IsTransition()) return false;
*state = MONOMORPHIC_PROTOTYPE_FAILURE;
}
return true;
--
--
v8-dev mailing list
[email protected]
http://groups.google.com/group/v8-dev
---
You received this message because you are subscribed to the Google Groups "v8-dev" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
For more options, visit https://groups.google.com/groups/opt_out.
