Revision: 15031
Author: [email protected]
Date: Mon Jun 10 04:27:09 2013
Log: Lookup transition again after migrating a transition target.
[email protected]
BUG=chromium:242332
Review URL: https://chromiumcodereview.appspot.com/16347005
http://code.google.com/p/v8/source/detail?r=15031
Modified:
/branches/bleeding_edge/src/ic.cc
=======================================
--- /branches/bleeding_edge/src/ic.cc Wed Jun 5 04:12:49 2013
+++ /branches/bleeding_edge/src/ic.cc Mon Jun 10 04:27:09 2013
@@ -1541,6 +1541,10 @@
Handle<Map> target(lookup->GetTransitionMapFromMap(receiver->map()));
Map::GeneralizeRepresentation(
target, target->LastAdded(), value->OptimalRepresentation());
+ // Lookup the transition again since the transition tree may have
changed
+ // entirely by the migration above.
+ receiver->map()->LookupTransition(*holder, *name, lookup);
+ if (!lookup->IsTransition()) return false;
*state = MONOMORPHIC_PROTOTYPE_FAILURE;
}
return true;
--
--
v8-dev mailing list
[email protected]
http://groups.google.com/group/v8-dev
---
You received this message because you are subscribed to the Google Groups "v8-dev" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
For more options, visit https://groups.google.com/groups/opt_out.
