Chromium Code Reviews
chromiumcodereview-hr@appspot.gserviceaccount.com (chromiumcodereview-hr) | Please choose your nickname with Settings | Help | Chromium Project | Gerrit Changes | Sign out
(199)

Unified Diff: src/objects.cc

Issue 9808111: Fix missing write barrier in CopyObjectToObjectElements. (Closed) Base URL: https://v8.googlecode.com/svn/branches/bleeding_edge
Patch Set: Created 8 years, 9 months ago
Use n/p to move between diff chunks; N/P to move between comments. Draft comments are only viewable by you.
Jump to:
View side-by-side diff with in-line comments
Download patch
« no previous file with comments | « src/elements.cc ('k') | test/mjsunit/regress/regress-crbug-119926.js » ('j') | no next file with comments »
Expand Comments ('e') | Collapse Comments ('c') | Show Comments Hide Comments ('s')
Index: src/objects.cc
diff --git a/src/objects.cc b/src/objects.cc
index fa4f943dca48f700965fda5f16d6d0b2fff723af..64d85a0685a98470ad66df6207a6f18f8448eeae 100644
--- a/src/objects.cc
+++ b/src/objects.cc
@@ -8454,7 +8454,7 @@ MaybeObject* JSObject::SetFastElementsCapacityAndLength(
? FAST_SMI_ONLY_ELEMENTS
: FAST_ELEMENTS;
// int copy_size = Min(old_elements_raw->length(), new_elements->length());
- accessor->CopyElements(this, new_elements, to_kind, SKIP_WRITE_BARRIER);
+ accessor->CopyElements(this, new_elements, to_kind);
if (elements_kind != NON_STRICT_ARGUMENTS_ELEMENTS) {
set_map_and_elements(new_map, new_elements);
} else {
@@ -8498,8 +8498,7 @@ MaybeObject* JSObject::SetFastDoubleElementsCapacityAndLength(
FixedArrayBase* old_elements = elements();
ElementsKind elements_kind = GetElementsKind();
ElementsAccessor* accessor = ElementsAccessor::ForKind(elements_kind);
- accessor->CopyElements(this, elems, FAST_DOUBLE_ELEMENTS,
- SKIP_WRITE_BARRIER);
+ accessor->CopyElements(this, elems, FAST_DOUBLE_ELEMENTS);
if (elements_kind != NON_STRICT_ARGUMENTS_ELEMENTS) {
set_map_and_elements(new_map, elems);
} else {
« no previous file with comments | « src/elements.cc ('k') | test/mjsunit/regress/regress-crbug-119926.js » ('j') | no next file with comments »

Powered by Google App Engine
This is Rietveld 408576698