GCMole evaluation order issue in CallIC::DoCustomHandler().

R=jarin@chromium.org

Review URL: https://codereview.chromium.org/296693011

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@21435 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

diff --git a/src/ic.cc b/src/ic.cc
index 38a0c14..90beb36 100644 (file)
--- a/src/ic.cc
+++ b/src/ic.cc
@@ -1850,7 +1850,8 @@ bool CallIC::DoCustomHandler(Handle<Object> receiver,
       isolate()->context()->native_context()->array_function(), isolate());
   if (array_function.is_identical_to(Handle<JSFunction>::cast(function))) {
     // Alter the slot.
-    vector->set(slot->value(), *isolate()->factory()->NewAllocationSite());
+    Handle<AllocationSite> new_site = isolate()->factory()->NewAllocationSite();
+    vector->set(slot->value(), *new_site);
     State new_state = state.ToMonomorphicArrayCallState();
     CallICStub stub(isolate(), new_state);
     set_target(*stub.GetCode());