AuroraMiddleware/v8
1
0
Fork 0
Code Issues 2 Pull Requests Releases Wiki Activity

Fix issue with Map/SetIterator and types

Browse Source 
BUG=v8:3281
LOG=N
R=jkummerow@chromium.org

Review URL: https://codereview.chromium.org/246993003

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@20893 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
This commit is contained in:
adamk@chromium.org 2014-04-22 18:14:46 +00:00
parent 691865653f
commit 71750f7be8
2 changed files with 15 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
src/types.cc
View File

@ -226,6 +226,8 @@ int TypeImpl<Config>::BitsetType::Lub(i::Map* map) {
case JS_DATA_VIEW_TYPE:
case JS_SET_TYPE:
case JS_MAP_TYPE:
case JS_SET_ITERATOR_TYPE:
case JS_MAP_ITERATOR_TYPE:
case JS_WEAK_MAP_TYPE:
case JS_WEAK_SET_TYPE:
if (map->is_undetectable()) return kUndetectable;

13
test/mjsunit/regress/regress-3281.js Normal file
View File

@ -0,0 +1,13 @@
// Copyright 2014 the V8 project authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
// Flags: --allow-natives-syntax --harmony-collections
// Should not crash or raise an exception.
var s = new Set();
var setIterator = %SetCreateIterator(s, 2);
var m = new Map();
var mapIterator = %MapCreateIterator(m, 2);