Revision: 14066
Author: verwa...@chromium.org
Date: Mon Mar 25 08:59:08 2013
Log: Add AssertNoAllocation to ensure TransitionArray* transitions is
safe.
Review URL: https://chromiumcodereview.appspot.com/12583013
http://code.google.com/p/v8/source/detail?r=14066
Modified:
/branches/bleeding_edge/src/objects-inl.h
=======================================
--- /branches/bleeding_edge/src/objects-inl.h Mon Mar 25 08:18:52 2013
+++ /branches/bleeding_edge/src/objects-inl.h Mon Mar 25 08:59:08 2013
@@ -1490,13 +1490,17 @@
bool JSObject::TryTransitionToField(Handle<JSObject> object,
Handle<Name> key) {
if (!object->map()->HasTransitionArray()) return false;
- TransitionArray* transitions = object->map()->transitions();
- int transition = transitions->Search(*key);
- if (transition == TransitionArray::kNotFound) return false;
- PropertyDetails target_details =
transitions->GetTargetDetails(transition);
- if (target_details.type() != FIELD) return false;
- if (target_details.attributes() != NONE) return false;
- Handle<Map> target(transitions->GetTarget(transition));
+ Handle<Map> target;
+ {
+ AssertNoAllocation no_allocation;
+ TransitionArray* transitions = object->map()->transitions();
+ int transition = transitions->Search(*key);
+ if (transition == TransitionArray::kNotFound) return false;
+ PropertyDetails target_details =
transitions->GetTargetDetails(transition);
+ if (target_details.type() != FIELD) return false;
+ if (target_details.attributes() != NONE) return false;
+ target = Handle<Map>(transitions->GetTarget(transition));
+ }
JSObject::AddFastPropertyUsingMap(object, target);
return true;
}
--
--
v8-dev mailing list
v8-dev@googlegroups.com
http://groups.google.com/group/v8-dev
---
You received this message because you are subscribed to the Google Groups "v8-dev" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to v8-dev+unsubscr...@googlegroups.com.
For more options, visit https://groups.google.com/groups/opt_out.
