AuroraMiddleware/v8
1
0
Fork 0
Code Issues 2 Pull Requests Releases Wiki Activity

Clear descriptor pointer when normalizing properties.

Browse Source 
Review URL: https://chromiumcodereview.appspot.com/10909029

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12421 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
This commit is contained in:
verwaest@chromium.org 2012-08-31 17:10:44 +00:00
parent 2e652e6f91
commit 9b7a673d47
1 changed files with 5 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
src/objects.cc
View File

@ -3296,6 +3296,7 @@ MaybeObject* JSObject::NormalizeProperties(PropertyNormalizationMode mode,
}
case CALLBACKS: {
Object* value = descs->GetCallbacksObject(i);
details = details.set_pointer(0);
MaybeObject* maybe_dictionary =
dictionary->Add(descs->GetKey(i), value, details);
if (!maybe_dictionary->To(&dictionary)) return maybe_dictionary;
@ -12275,6 +12276,8 @@ template<typename Shape, typename Key>
MaybeObject* Dictionary<Shape, Key>::Add(Key key,
Object* value,
PropertyDetails details) {
ASSERT(details.dictionary_index() == details.descriptor_index());
// Valdate key is absent.
SLOW_ASSERT((this->FindEntry(key) == Dictionary<Shape, Key>::kNotFound));
// Check whether the dictionary should be extended.
@ -12612,7 +12615,8 @@ MaybeObject* StringDictionary::TransformPropertiesToFastFor(
if (!maybe_key->To(&key)) return maybe_key;
PropertyDetails details = DetailsAt(i);
int enumeration_index = details.dictionary_index();
ASSERT(details.descriptor_index() == details.dictionary_index());
int enumeration_index = details.descriptor_index();
PropertyType type = details.type();
if (value->IsJSFunction() && !heap->InNewSpace(value)) {