AuroraMiddleware/v8
1
0
Fork 0
Code Issues 2 Pull Requests Releases Wiki Activity

Fixed DCHECK in StoreIC::CompileHandler().

Browse Source 
BUG=chromium:489597
LOG=N

Review URL: https://codereview.chromium.org/1123153005

Cr-Commit-Position: refs/heads/master@{#28518}
This commit is contained in:
ishell 2015-05-20 06:36:47 -07:00 committed by Commit bot
parent f32a3643b5
commit 1c673a56c1
3 changed files with 19 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
src/ic/ic.cc
View File

@ -1625,7 +1625,8 @@ Handle<Code> StoreIC::CompileHandler(LookupIterator* lookup,
// This is currently guaranteed by checks in StoreIC::Store.
Handle<JSObject> receiver = Handle<JSObject>::cast(lookup->GetReceiver());
Handle<JSObject> holder = lookup->GetHolder<JSObject>();
DCHECK(!receiver->IsAccessCheckNeeded());
DCHECK(!receiver->IsAccessCheckNeeded() ||
isolate()->IsInternallyUsedPropertyName(lookup->name()));
switch (lookup->state()) {
case LookupIterator::TRANSITION: {

12
test/mjsunit/regress/regress-crbug-489597.js Normal file
View File

@ -0,0 +1,12 @@
// Copyright 2015 the V8 project authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
try {
load("test/mjsunit/regress/regress-crbug-489597.js-script");
} catch (e) {
}
var o = this;
Error.captureStackTrace(o);
o.stack;

5
test/mjsunit/regress/regress-crbug-489597.js-script Normal file
View File

@ -0,0 +1,5 @@
// Copyright 2015 the V8 project authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
throw new Error("boom");