Chromium Code Reviews
chromiumcodereview-hr@appspot.gserviceaccount.com (chromiumcodereview-hr) | Please choose your nickname with Settings | Help | Chromium Project | Gerrit Changes | Sign out
(2)

Unified Diff: src/objects.cc

Issue 292173011: Harden a few builtins (Closed) Base URL: https://v8.googlecode.com/svn/branches/bleeding_edge
Patch Set: rebased Created 6 years, 7 months ago
Use n/p to move between diff chunks; N/P to move between comments. Draft comments are only viewable by you.
Jump to:
View side-by-side diff with in-line comments
Download patch
« no previous file with comments | « src/isolate.cc ('k') | src/promise.js » ('j') | no next file with comments »
Expand Comments ('e') | Collapse Comments ('c') | Show Comments Hide Comments ('s')
Index: src/objects.cc
diff --git a/src/objects.cc b/src/objects.cc
index ddeaacd6b44011e6bd1cfd8ee12e377fa154adc7..c301670c128944301a53cdb99ddb8f76fc04e67d 100644
--- a/src/objects.cc
+++ b/src/objects.cc
@@ -14263,7 +14263,7 @@ int JSObject::GetLocalElementKeys(FixedArray* storage,
case FAST_HOLEY_DOUBLE_ELEMENTS: {
int length = IsJSArray() ?
Smi::cast(JSArray::cast(this)->length())->value() :
- FixedDoubleArray::cast(elements())->length();
+ FixedArrayBase::cast(elements())->length();
for (int i = 0; i < length; i++) {
if (!FixedDoubleArray::cast(elements())->is_the_hole(i)) {
if (storage != NULL) {
« no previous file with comments | « src/isolate.cc ('k') | src/promise.js » ('j') | no next file with comments »

Powered by Google App Engine
This is Rietveld 408576698