AuroraMiddleware/v8
1
0
Fork 0
Code Issues 2 Pull Requests Releases Wiki Activity

Restore the descriptor array before returning allocation failure.

Browse Source 
BUG=chromium:151750

Review URL: https://chromiumcodereview.appspot.com/10989076

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12629 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
This commit is contained in:
verwaest@chromium.org 2012-09-28 10:15:58 +00:00
parent f623eefddb
commit 6fd0e69156
1 changed files with 4 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
src/objects.cc
View File

@ -1782,8 +1782,11 @@ MaybeObject* JSObject::ConvertTransitionToMapTransition(
old_target->SetBackPointer(GetHeap()->undefined_value());
MaybeObject* maybe_failure = old_target->SetDescriptors(old_descriptors);
if (maybe_failure->IsFailure()) return maybe_failure;
// Reset the backpointer before returning failure, otherwise the map ends up
// with an undefined backpointer and no descriptors, losing its own
// descriptors. Setting the backpointer always succeeds.
old_target->SetBackPointer(old_map);
if (maybe_failure->IsFailure()) return maybe_failure;
old_map->set_owns_descriptors(true);
}