Fix
BUG= R=ishell@chromium.org Review URL: https://codereview.chromium.org/431483003 git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@22707 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
This commit is contained in:
parent
2c2fce0c94
commit
156fba0554
@ -831,7 +831,7 @@ Register NamedLoadHandlerCompiler::CallbackFrontend(Register object_reg,
|
|||||||
ASSERT(!AreAliased(reg, scratch2, scratch3, dictionary));
|
ASSERT(!AreAliased(reg, scratch2, scratch3, dictionary));
|
||||||
|
|
||||||
if (!holder()->HasFastProperties()) {
|
if (!holder()->HasFastProperties()) {
|
||||||
ASSERT(holder()->IsGlobalObject());
|
ASSERT(!holder()->IsGlobalObject());
|
||||||
// Load the properties dictionary.
|
// Load the properties dictionary.
|
||||||
__ Ldr(dictionary, FieldMemOperand(reg, JSObject::kPropertiesOffset));
|
__ Ldr(dictionary, FieldMemOperand(reg, JSObject::kPropertiesOffset));
|
||||||
|
|
||||||
|
@ -969,11 +969,11 @@ Handle<Code> NamedStoreHandlerCompiler::CompileStoreTransition(
|
|||||||
// Find the top object.
|
// Find the top object.
|
||||||
Handle<JSObject> last;
|
Handle<JSObject> last;
|
||||||
PrototypeIterator iter(isolate(), holder());
|
PrototypeIterator iter(isolate(), holder());
|
||||||
do {
|
while (!iter.IsAtEnd()) {
|
||||||
last = Handle<JSObject>::cast(PrototypeIterator::GetCurrent(iter));
|
last = Handle<JSObject>::cast(PrototypeIterator::GetCurrent(iter));
|
||||||
iter.Advance();
|
iter.Advance();
|
||||||
} while (!iter.IsAtEnd());
|
}
|
||||||
set_holder(last);
|
if (!last.is_null()) set_holder(last);
|
||||||
}
|
}
|
||||||
|
|
||||||
Register holder_reg = FrontendHeader(receiver(), name, &miss);
|
Register holder_reg = FrontendHeader(receiver(), name, &miss);
|
||||||
|
Loading…
Reference in New Issue
Block a user