Chromium Code Reviews
chromiumcodereview-hr@appspot.gserviceaccount.com (chromiumcodereview-hr) | Please choose your nickname with Settings | Help | Chromium Project | Gerrit Changes | Sign out
(260)

Unified Diff: src/objects.cc

Issue 1234553002: Reload the map of typed arrays after performing ToNumber. (Closed) Base URL: https://chromium.googlesource.com/v8/v8.git@master
Patch Set: Created 5 years, 5 months ago
Use n/p to move between diff chunks; N/P to move between comments. Draft comments are only viewable by you.
Jump to:
View side-by-side diff with in-line comments
Download patch
« no previous file with comments | « src/lookup.cc ('k') | test/mjsunit/regress/regress-507980.js » ('j') | no next file with comments »
Expand Comments ('e') | Collapse Comments ('c') | Show Comments Hide Comments ('s')
Index: src/objects.cc
diff --git a/src/objects.cc b/src/objects.cc
index d1488dd9d03ca8cb67f33841a7f38c33e9965ec3..be0fb6df12af30867c515782b5d6ab5979722a0d 100644
--- a/src/objects.cc
+++ b/src/objects.cc
@@ -3292,6 +3292,12 @@ MaybeHandle<Object> Object::SetDataProperty(LookupIterator* it,
ASSIGN_RETURN_ON_EXCEPTION(it->isolate(), to_assign,
Execution::ToNumber(it->isolate(), value),
Object);
+ // ToNumber above might modify the receiver, causing the cached
+ // holder_map to mismatch the actual holder->map() after this point.
+ // Reload the map to be in consistent state. Other cached state cannot
+ // have been invalidated since typed array elements cannot be reconfigured
+ // in any way.
+ it->ReloadHolderMap();
}
}
« no previous file with comments | « src/lookup.cc ('k') | test/mjsunit/regress/regress-507980.js » ('j') | no next file with comments »

Powered by Google App Engine
This is Rietveld 408576698