From 71750f7be8f90360c52959d9e7c0591b1dd62aef Mon Sep 17 00:00:00 2001 From: "adamk@chromium.org" Date: Tue, 22 Apr 2014 18:14:46 +0000 Subject: [PATCH] Fix issue with Map/SetIterator and types BUG=v8:3281 LOG=N R=jkummerow@chromium.org Review URL: https://codereview.chromium.org/246993003 git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@20893 ce2b1a6d-e550-0410-aec6-3dcde31c8c00 --- src/types.cc | 2 ++ test/mjsunit/regress/regress-3281.js | 13 +++++++++++++ 2 files changed, 15 insertions(+) create mode 100644 test/mjsunit/regress/regress-3281.js diff --git a/src/types.cc b/src/types.cc index 394f772679..705b64e706 100644 --- a/src/types.cc +++ b/src/types.cc @@ -226,6 +226,8 @@ int TypeImpl::BitsetType::Lub(i::Map* map) { case JS_DATA_VIEW_TYPE: case JS_SET_TYPE: case JS_MAP_TYPE: + case JS_SET_ITERATOR_TYPE: + case JS_MAP_ITERATOR_TYPE: case JS_WEAK_MAP_TYPE: case JS_WEAK_SET_TYPE: if (map->is_undetectable()) return kUndetectable; diff --git a/test/mjsunit/regress/regress-3281.js b/test/mjsunit/regress/regress-3281.js new file mode 100644 index 0000000000..ebb25991d8 --- /dev/null +++ b/test/mjsunit/regress/regress-3281.js @@ -0,0 +1,13 @@ +// Copyright 2014 the V8 project authors. All rights reserved. +// Use of this source code is governed by a BSD-style license that can be +// found in the LICENSE file. + +// Flags: --allow-natives-syntax --harmony-collections + +// Should not crash or raise an exception. + +var s = new Set(); +var setIterator = %SetCreateIterator(s, 2); + +var m = new Map(); +var mapIterator = %MapCreateIterator(m, 2);