AuroraMiddleware/v8
1
0
Fork 0
Code Issues 2 Pull Requests Releases Wiki Activity

Fix promotion of JSFunctions with in-object properties.

Browse Source 
BUG=v8:4572, chromium:561481
LOG=Y

Review URL: https://codereview.chromium.org/1465223007

Cr-Commit-Position: refs/heads/master@{#32295}
This commit is contained in:
ishell 2015-11-25 11:21:33 -08:00 committed by Commit bot
parent 189ec6a023
commit 064bbccfa9
1 changed files with 1 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
src/heap/scavenger.cc
View File

@ -192,12 +192,7 @@ class ScavengingVisitor : public StaticVisitorBase {
*slot = target;
if (object_contents == POINTER_OBJECT) {
if (map->instance_type() == JS_FUNCTION_TYPE) {
heap->promotion_queue()->insert(target,
JSFunction::kNonWeakFieldsEndOffset);
} else {
heap->promotion_queue()->insert(target, object_size);
}
heap->promotion_queue()->insert(target, object_size);
}
heap->IncrementPromotedObjectsSize(object_size);
return true;