Chromium Code Reviews
chromiumcodereview-hr@appspot.gserviceaccount.com (chromiumcodereview-hr) | Please choose your nickname with Settings | Help | Chromium Project | Gerrit Changes | Sign out
(425)

Unified Diff: src/hydrogen.cc

Issue 16190008: Fast literals: fixed initialization of non-copied in-object property fields (Closed) Base URL: https://v8.googlecode.com/svn/branches/bleeding_edge
Patch Set: addressed comment Created 7 years, 7 months ago
Use n/p to move between diff chunks; N/P to move between comments. Draft comments are only viewable by you.
Jump to:
View side-by-side diff with in-line comments
Download patch
« no previous file with comments | « no previous file | test/mjsunit/regress/regress-crbug-245424.js » ('j') | no next file with comments »
Expand Comments ('e') | Collapse Comments ('c') | Show Comments Hide Comments ('s')
Index: src/hydrogen.cc
diff --git a/src/hydrogen.cc b/src/hydrogen.cc
index 54a522506287259d83a7684002e5ad1fac33fc07..7ee6081026b7c58a786a3e3a5985a69259b1f787 100644
--- a/src/hydrogen.cc
+++ b/src/hydrogen.cc
@@ -10059,7 +10059,9 @@ void HOptimizedGraphBuilder::BuildEmitInObjectProperties(
HConstant(isolate()->factory()->one_pointer_filler_map(),
Representation::Tagged()));
for (int i = copied_fields; i < inobject_properties; i++) {
- HObjectAccess access = HObjectAccess::ForJSObjectOffset(i);
+ ASSERT(boilerplate_object->IsJSObject());
+ int property_offset = boilerplate_object->GetInObjectPropertyOffset(i);
+ HObjectAccess access = HObjectAccess::ForJSObjectOffset(property_offset);
AddStore(object_properties, access, value_instruction);
}
}
« no previous file with comments | « no previous file | test/mjsunit/regress/regress-crbug-245424.js » ('j') | no next file with comments »

Powered by Google App Engine
This is Rietveld 408576698