Reviewers: Sven,
Description:
This fixes chromium:91517.
Please review this at http://codereview.chromium.org/7566032/
SVN Base: http://v8.googlecode.com/svn/branches/3.4/
Affected files:
M src/objects.h
M src/objects.cc
M src/runtime.cc
M src/version.cc
A + test/mjsunit/regress/regress-91517.js
### BEGIN SVN COPY METADATA
#$ cp branches/bleeding_edge/test/mjsunit/regress/regress-91517.js
test/mjsunit/regress/regress-91517.js
### END SVN COPY METADATA
Index: src/objects.cc
===================================================================
--- src/objects.cc (revision 8826)
+++ src/objects.cc (working copy)
@@ -9566,7 +9566,9 @@
}
ASSERT(storage->length() >= index);
} else {
- property_dictionary()->CopyKeysTo(storage, StringDictionary::UNSORTED);
+ property_dictionary()->CopyKeysTo(storage,
+ index,
+ StringDictionary::UNSORTED);
}
}
@@ -10316,6 +10318,7 @@
template void Dictionary<StringDictionaryShape, String*>::CopyKeysTo(
FixedArray*,
+ int,
Dictionary<StringDictionaryShape, String*>::SortMode);
template int
@@ -11414,11 +11417,11 @@
template<typename Shape, typename Key>
void Dictionary<Shape, Key>::CopyKeysTo(
FixedArray* storage,
+ int index,
typename Dictionary<Shape, Key>::SortMode sort_mode) {
ASSERT(storage->length() >= NumberOfElementsFilterAttributes(
static_cast<PropertyAttributes>(NONE)));
int capacity = HashTable<Shape, Key>::Capacity();
- int index = 0;
for (int i = 0; i < capacity; i++) {
Object* k = HashTable<Shape, Key>::KeyAt(i);
if (HashTable<Shape, Key>::IsKey(k)) {
Index: src/objects.h
===================================================================
--- src/objects.h (revision 8826)
+++ src/objects.h (working copy)
@@ -2761,7 +2761,7 @@
PropertyAttributes filter,
SortMode sort_mode);
// Fill in details for properties into storage.
- void CopyKeysTo(FixedArray* storage, SortMode sort_mode);
+ void CopyKeysTo(FixedArray* storage, int index, SortMode sort_mode);
// Accessors for next enumeration index.
void SetNextEnumerationIndex(int index) {
Index: src/runtime.cc
===================================================================
--- src/runtime.cc (revision 8826)
+++ src/runtime.cc (working copy)
@@ -4460,9 +4460,10 @@
// Get the property names.
jsproto = obj;
int proto_with_hidden_properties = 0;
+ int next_copy_index = 0;
for (int i = 0; i < length; i++) {
- jsproto->GetLocalPropertyNames(*names,
- i == 0 ? 0 : local_property_count[i -
1]);
+ jsproto->GetLocalPropertyNames(*names, next_copy_index);
+ next_copy_index += local_property_count[i];
if (!GetHiddenProperties(jsproto, false)->IsUndefined()) {
proto_with_hidden_properties++;
}
Index: src/version.cc
===================================================================
--- src/version.cc (revision 8826)
+++ src/version.cc (working copy)
@@ -35,7 +35,7 @@
#define MAJOR_VERSION 3
#define MINOR_VERSION 4
#define BUILD_NUMBER 14
-#define PATCH_LEVEL 7
+#define PATCH_LEVEL 8
// Use 1 for candidates and 0 otherwise.
// (Boolean macro values are not supported by all preprocessors.)
#define IS_CANDIDATE_VERSION 0
Index: test/mjsunit/regress/regress-91517.js
--
v8-dev mailing list
[email protected]
http://groups.google.com/group/v8-dev
