Chromium Code Reviews
chromiumcodereview-hr@appspot.gserviceaccount.com (chromiumcodereview-hr) | Please choose your nickname with Settings | Help | Chromium Project | Gerrit Changes | Sign out
(910)

Unified Diff: src/elements.cc

Issue 9968056: Properly support shrinking arrays in CopyDictionaryToObjectElements. (Closed) Base URL: https://v8.googlecode.com/svn/branches/bleeding_edge
Patch Set: Extend test case Created 8 years, 9 months ago
Use n/p to move between diff chunks; N/P to move between comments. Draft comments are only viewable by you.
Jump to:
View side-by-side diff with in-line comments
Download patch
« no previous file with comments | « no previous file | test/mjsunit/regress/regress-121407.js » ('j') | no next file with comments »
Expand Comments ('e') | Collapse Comments ('c') | Show Comments Hide Comments ('s')
Index: src/elements.cc
diff --git a/src/elements.cc b/src/elements.cc
index 0fc3c539acef86284868548c0a18bec6df849717..26d3dc135cdd9c9b99a1e1921adc671dd405b600 100644
--- a/src/elements.cc
+++ b/src/elements.cc
@@ -199,10 +199,13 @@ static void CopyDictionaryToObjectElements(SeededNumberDictionary* from,
}
#endif
}
- ASSERT((copy_size + static_cast<int>(to_start)) <= to->length());
ASSERT(to != from);
ASSERT(to_kind == FAST_ELEMENTS || to_kind == FAST_SMI_ONLY_ELEMENTS);
if (copy_size == 0) return;
+ uint32_t to_length = to->length();
+ if (to_start + copy_size > to_length) {
Michael Starzinger 2012/04/03 08:13:18 I suspect that without the cast this will lead to
+ copy_size = to_length - to_start;
+ }
for (int i = 0; i < copy_size; i++) {
int entry = from->FindEntry(i + from_start);
if (entry != SeededNumberDictionary::kNotFound) {
@@ -356,8 +359,11 @@ static void CopyDictionaryToDoubleElements(SeededNumberDictionary* from,
}
}
}
- ASSERT(copy_size + static_cast<int>(to_start) <= to->length());
if (copy_size == 0) return;
+ uint32_t to_length = to->length();
+ if (to_start + copy_size > to_length) {
+ copy_size = to_length - to_start;
+ }
for (int i = 0; i < copy_size; i++) {
int entry = from->FindEntry(i + from_start);
if (entry != SeededNumberDictionary::kNotFound) {
« no previous file with comments | « no previous file | test/mjsunit/regress/regress-121407.js » ('j') | no next file with comments »

Powered by Google App Engine
This is Rietveld 408576698