Fix
BUG= R=ishell@chromium.org Review URL: https://codereview.chromium.org/431483003 git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@22707 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
This commit is contained in:
parent
2c2fce0c94
commit
156fba0554
@ -831,7 +831,7 @@ Register NamedLoadHandlerCompiler::CallbackFrontend(Register object_reg,
|
||||
ASSERT(!AreAliased(reg, scratch2, scratch3, dictionary));
|
||||
|
||||
if (!holder()->HasFastProperties()) {
|
||||
ASSERT(holder()->IsGlobalObject());
|
||||
ASSERT(!holder()->IsGlobalObject());
|
||||
// Load the properties dictionary.
|
||||
__ Ldr(dictionary, FieldMemOperand(reg, JSObject::kPropertiesOffset));
|
||||
|
||||
|
@ -969,11 +969,11 @@ Handle<Code> NamedStoreHandlerCompiler::CompileStoreTransition(
|
||||
// Find the top object.
|
||||
Handle<JSObject> last;
|
||||
PrototypeIterator iter(isolate(), holder());
|
||||
do {
|
||||
while (!iter.IsAtEnd()) {
|
||||
last = Handle<JSObject>::cast(PrototypeIterator::GetCurrent(iter));
|
||||
iter.Advance();
|
||||
} while (!iter.IsAtEnd());
|
||||
set_holder(last);
|
||||
}
|
||||
if (!last.is_null()) set_holder(last);
|
||||
}
|
||||
|
||||
Register holder_reg = FrontendHeader(receiver(), name, &miss);
|
||||
|
Loading…
Reference in New Issue
Block a user