From 557fc46b6231698fbd13436c9b6171fe7e7bee56 Mon Sep 17 00:00:00 2001 From: "svenpanne@chromium.org" Date: Wed, 8 Feb 2012 07:23:14 +0000 Subject: [PATCH] Fixed assertions when accessing the hidden properties dictionary. TBR=jkummerow@chromium.org Review URL: https://chromiumcodereview.appspot.com/9360012 git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10627 ce2b1a6d-e550-0410-aec6-3dcde31c8c00 --- src/objects.cc | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/src/objects.cc b/src/objects.cc index eedd9ee193..e4f165ae44 100644 --- a/src/objects.cc +++ b/src/objects.cc @@ -3779,7 +3779,8 @@ MaybeObject* JSObject::GetHiddenPropertiesDictionary(bool create_if_absent) { this->FastPropertyAt(descriptors->GetFieldIndex(0)); return StringDictionary::cast(hidden_store); } else { - ASSERT(descriptors->GetType(0) == MAP_TRANSITION); + ASSERT(descriptors->GetType(0) == NULL_DESCRIPTOR || + descriptors->GetType(0) == MAP_TRANSITION); } } } else { @@ -3826,7 +3827,8 @@ MaybeObject* JSObject::SetHiddenPropertiesDictionary( this->FastPropertyAtPut(descriptors->GetFieldIndex(0), dictionary); return this; } else { - ASSERT(descriptors->GetType(0) == MAP_TRANSITION); + ASSERT(descriptors->GetType(0) == NULL_DESCRIPTOR || + descriptors->GetType(0) == MAP_TRANSITION); } } }