AuroraMiddleware/v8
1
0
Fork 0
Code Issues 2 Pull Requests Releases Wiki Activity

Use JSObjectVerify instead of trying to reimplement parts of it.

Browse Source 
R=verwaest@chromium.org
BUG=chromium:573857
LOG=n

Review URL: https://codereview.chromium.org/1551333002

Cr-Commit-Position: refs/heads/master@{#33083}
This commit is contained in:
bmeurer 2016-01-04 05:49:48 -08:00 committed by Commit bot
parent 09c41d9bfd
commit fed2c416df
3 changed files with 15 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
src/objects-debug.cc
View File

@ -549,10 +549,7 @@ void SlicedString::SlicedStringVerify() {
void JSBoundFunction::JSBoundFunctionVerify() {
CHECK(IsJSBoundFunction());
if (HasFastProperties()) {
VerifyObjectField(kLengthOffset);
VerifyObjectField(kNameOffset);
}
JSObjectVerify();
VerifyObjectField(kBoundThisOffset);
VerifyObjectField(kBoundTargetFunctionOffset);
VerifyObjectField(kBoundArgumentsOffset);

1
test/mjsunit/mjsunit.status
View File

@ -1002,6 +1002,7 @@
'regress/regress-crbug-568477-3': [SKIP],
'regress/regress-crbug-568477-4': [SKIP],
'regress/regress-crbug-572590': [SKIP],
'regress/regress-crbug-573857': [SKIP],
'regress/regress-deopt-gcb': [SKIP],
'regress/regress-deopt-gc': [SKIP],
'regress/regress-deopt-in-array-literal-spread': [SKIP],

13
test/mjsunit/regress/regress-crbug-573857.js Normal file
View File

@ -0,0 +1,13 @@
// Copyright 2015 the V8 project authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
// Flags: --expose-gc --verify-heap
function f() {}
f = f.bind();
f.x = f.name;
f.__defineGetter__('name', function() { return f.x; });
function g() {}
g.prototype = f;
gc();