AuroraMiddleware/v8
1
0
Fork 0
Code Issues 2 Pull Requests Releases Wiki Activity

Fix for an assertion failure in Map::FindTransitionToField(...). Appeared after r25136.

Browse Source 
BUG=chromium:430846
LOG=N
R=verwaest@chromium.org

Review URL: https://codereview.chromium.org/704183002

Cr-Commit-Position: refs/heads/master@{#25185}
git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@25185 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
This commit is contained in:
ishell@chromium.org 2014-11-06 11:49:34 +00:00
parent 0b985c492e
commit e1f93a82f2
2 changed files with 17 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
src/objects-inl.h
View File

@ -1886,8 +1886,9 @@ Handle<Map> Map::FindTransitionToField(Handle<Map> map, Handle<Name> key) {
TransitionArray* transitions = map->transitions();
int transition = transitions->Search(FIELD, *key, NONE);
if (transition == TransitionArray::kNotFound) return Handle<Map>::null();
DCHECK_EQ(FIELD, transitions->GetTargetDetails(transition).type());
DCHECK_EQ(NONE, transitions->GetTargetDetails(transition).attributes());
PropertyDetails details = transitions->GetTargetDetails(transition);
if (details.type() != FIELD) return Handle<Map>::null();
DCHECK_EQ(NONE, details.attributes());
return Handle<Map>(transitions->GetTarget(transition));
}

14
test/mjsunit/regress/regress-crbug-430846.js Normal file
View File

@ -0,0 +1,14 @@
// Copyright 2014 the V8 project authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
// Flags: --allow-natives-syntax
function foo() { return 1; };
var o1 = {};
o1.foo = foo;
var json = '{"foo": {"x": 1}}';
var o2 = JSON.parse(json);
var o3 = JSON.parse(json);
assertTrue(%HaveSameMap(o2, o3));