Reviewers: danno,
Message:
PTAL
Description:
Store copied value rather than the original double.
Please review this at https://chromiumcodereview.appspot.com/23262002/
SVN Base: https://v8.googlecode.com/svn/branches/bleeding_edge
Affected files:
M src/objects.cc
A + test/mjsunit/regress/regress-convert-function-to-double.js
Index: src/objects.cc
diff --git a/src/objects.cc b/src/objects.cc
index
995ed36f0228b9982dd08f50fc9ef0dd54406b9d..38d8647b525c8cb56549af9758848ed887c194dc
100644
--- a/src/objects.cc
+++ b/src/objects.cc
@@ -2231,7 +2231,7 @@ MaybeObject* JSObject::ConvertDescriptorToField(Name*
name,
if (new_properties != NULL) {
set_properties(new_properties);
}
- FastPropertyAtPut(index, new_value);
+ FastPropertyAtPut(index, storage);
return new_value;
}
Index: test/mjsunit/regress/regress-convert-function-to-double.js
diff --git a/test/mjsunit/regress/regress-crbug-172345.js
b/test/mjsunit/regress/regress-convert-function-to-double.js
similarity index 93%
copy from test/mjsunit/regress/regress-crbug-172345.js
copy to test/mjsunit/regress/regress-convert-function-to-double.js
index
711501caa791f2974635ac4dd894568a2e3fc982..fca44f96324383a43daf393174f845d14f94bd9e
100644
--- a/test/mjsunit/regress/regress-crbug-172345.js
+++ b/test/mjsunit/regress/regress-convert-function-to-double.js
@@ -25,10 +25,12 @@
// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
-function f(a,i) {
- return a[i];
+function f(v) {
+ this.func = v;
}
-f([1,2,3], "length");
-f([1,2,3], "length");
-f([1,2,3], 2);
+var o1 = new f(f);
+var d = 1.4;
+var o2 = new f(d);
+o2.func = 1.8;
+assertEquals(1.4, d)
--
--
v8-dev mailing list
[email protected]
http://groups.google.com/group/v8-dev
---
You received this message because you are subscribed to the Google Groups "v8-dev" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
For more options, visit https://groups.google.com/groups/opt_out.
