Fixed incorrect generalization of types in Map::ReconfigureProperty() introduced...

BUG=chromium:459512
LOG=N
TBR=verwaest@chromium.org

Review URL: https://codereview.chromium.org/936253002

Cr-Commit-Position: refs/heads/master@{#26731}

diff --git a/src/objects.cc b/src/objects.cc
index fd35c90..1842bb6 100644 (file)
--- a/src/objects.cc
+++ b/src/objects.cc
@@ -2815,8 +2815,8 @@ Handle<Map> Map::ReconfigureProperty(Handle<Map> old_map, int modify_index,
             Handle<HeapType> old_field_type =
                 GetFieldType(isolate, old_descriptors, i,
                              old_details.location(), next_representation);
-            old_field_type =
-                GeneralizeFieldType(old_field_type, next_field_type, isolate);
+            next_field_type =
+                GeneralizeFieldType(next_field_type, old_field_type, isolate);
           }
         } else {
           Handle<HeapType> old_field_type =