AuroraMiddleware/v8
1
0
Fork 0
Code Issues 2 Pull Requests Releases Wiki Activity

Fix assertion failure in JSBuiltinReducer::ReduceArrayIterator.

Browse Source 
TBR=bmeurer@chromium.org
BUG=chromium:671576

Review-Url: https://codereview.chromium.org/2550143004
Cr-Commit-Position: refs/heads/master@{#41518}
This commit is contained in:
yangguo 2016-12-06 05:09:38 -08:00 committed by Commit bot
parent 68624259e6
commit a610155c8c
2 changed files with 14 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
src/contexts.h
View File

@ -120,9 +120,9 @@ enum ContextLookupFlags {
V(WASM_RUNTIME_ERROR_FUNCTION_INDEX, JSFunction, wasm_runtime_error_function)
#define NATIVE_CONTEXT_JS_ARRAY_ITERATOR_MAPS(V) \
V(TYPED_ARRAY_KEY_ITERATOR_MAP_INDEX, Map, typed_array_key_iterator_map) \
V(FAST_ARRAY_KEY_ITERATOR_MAP_INDEX, Map, fast_array_key_iterator_map) \
V(GENERIC_ARRAY_KEY_ITERATOR_MAP_INDEX, Map, array_key_iterator_map) \
V(TYPED_ARRAY_KEY_ITERATOR_MAP_INDEX, Map, typed_array_key_iterator_map) \
\
V(UINT8_ARRAY_KEY_VALUE_ITERATOR_MAP_INDEX, Map, \
uint8_array_key_value_iterator_map) \

13
test/mjsunit/regress/regress-crbug-671576.js Normal file
View File

@ -0,0 +1,13 @@
// Copyright 2016 the V8 project authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
// Flags: --allow-natives-syntax
function f() {
for (var i of [NaN].keys());
}
f();
%OptimizeFunctionOnNextCall(f);
f();