Revision: 16125
Author: [email protected]
Date: Fri Aug 9 02:49:15 2013
Log: Fix handle unsafety in Deoptimizer::MaterializeNextHeapObject.
[email protected]
Review URL: https://codereview.chromium.org/22327008
http://code.google.com/p/v8/source/detail?r=16125
Modified:
/branches/bleeding_edge/src/deoptimizer.cc
=======================================
--- /branches/bleeding_edge/src/deoptimizer.cc Wed Aug 7 04:24:14 2013
+++ /branches/bleeding_edge/src/deoptimizer.cc Fri Aug 9 02:49:15 2013
@@ -1675,7 +1675,8 @@
arguments->set_elements(*array);
materialized_objects_->Add(arguments);
for (int i = 0; i < length; ++i) {
- array->set(i, *MaterializeNextValue());
+ Handle<Object> value = MaterializeNextValue();
+ array->set(i, *value);
}
} else {
// Dispatch on the instance type of the object to be materialized.
@@ -1692,10 +1693,13 @@
Handle<JSObject> object =
isolate_->factory()->NewJSObjectFromMap(map, NOT_TENURED,
false);
materialized_objects_->Add(object);
- object->set_properties(FixedArray::cast(*MaterializeNextValue()));
- object->set_elements(FixedArray::cast(*MaterializeNextValue()));
+ Handle<Object> properties = MaterializeNextValue();
+ Handle<Object> elements = MaterializeNextValue();
+ object->set_properties(FixedArray::cast(*properties));
+ object->set_elements(FixedArray::cast(*elements));
for (int i = 0; i < length - 3; ++i) {
- object->FastPropertyAtPut(i, *MaterializeNextValue());
+ Handle<Object> value = MaterializeNextValue();
+ object->FastPropertyAtPut(i, *value);
}
break;
}
--
--
v8-dev mailing list
[email protected]
http://groups.google.com/group/v8-dev
---
You received this message because you are subscribed to the Google Groups "v8-dev" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
For more options, visit https://groups.google.com/groups/opt_out.
