Fix

BUG=
R=ishell@chromium.org

Review URL: https://codereview.chromium.org/431483003

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@22707 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

diff --git a/src/arm64/stub-cache-arm64.cc b/src/arm64/stub-cache-arm64.cc
index 00b2d7f..32951e5 100644 (file)
--- a/src/arm64/stub-cache-arm64.cc
+++ b/src/arm64/stub-cache-arm64.cc
@@ -831,7 +831,7 @@ Register NamedLoadHandlerCompiler::CallbackFrontend(Register object_reg,
   ASSERT(!AreAliased(reg, scratch2, scratch3, dictionary));
 
   if (!holder()->HasFastProperties()) {
-    ASSERT(holder()->IsGlobalObject());
+    ASSERT(!holder()->IsGlobalObject());
     // Load the properties dictionary.
     __ Ldr(dictionary, FieldMemOperand(reg, JSObject::kPropertiesOffset));
 

diff --git a/src/stub-cache.cc b/src/stub-cache.cc
index 14bcc07..5381ff1 100644 (file)
--- a/src/stub-cache.cc
+++ b/src/stub-cache.cc
@@ -969,11 +969,11 @@ Handle<Code> NamedStoreHandlerCompiler::CompileStoreTransition(
     // Find the top object.
     Handle<JSObject> last;
     PrototypeIterator iter(isolate(), holder());
-    do {
+    while (!iter.IsAtEnd()) {
       last = Handle<JSObject>::cast(PrototypeIterator::GetCurrent(iter));
       iter.Advance();
-    } while (!iter.IsAtEnd());
-    set_holder(last);
+    }
+    if (!last.is_null()) set_holder(last);
   }
 
   Register holder_reg = FrontendHeader(receiver(), name, &miss);