Release buold fix
authordslomov@chromium.org <dslomov@chromium.org@ce2b1a6d-e550-0410-aec6-3dcde31c8c00>
Thu, 28 Mar 2013 13:07:41 +0000 (13:07 +0000)
committerdslomov@chromium.org <dslomov@chromium.org@ce2b1a6d-e550-0410-aec6-3dcde31c8c00>
Thu, 28 Mar 2013 13:07:41 +0000 (13:07 +0000)
TBR=rossberg@chromium.org

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@14092 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

src/runtime.cc

index d8c9c27..2e124be 100644 (file)
@@ -883,13 +883,12 @@ RUNTIME_FUNCTION(MaybeObject*, Runtime_ArrayBufferSliceImpl) {
   CONVERT_ARG_HANDLE_CHECKED(JSArrayBuffer, target, 1);
   CONVERT_DOUBLE_ARG_CHECKED(first, 2);
   size_t start = static_cast<size_t>(first);
-  size_t source_length = ArrayBufferAllocatedLength(isolate, *source);
   size_t target_length = ArrayBufferAllocatedLength(isolate, *target);
 
   if (target_length == 0)
     return isolate->heap()->undefined_value();
 
-  ASSERT(source_length - target_length >= start);
+  ASSERT(ArrayBufferAllocatedLength(isolate, *source) - target_length >= start);
   uint8_t* source_data = reinterpret_cast<uint8_t*>(source->backing_store());
   uint8_t* target_data = reinterpret_cast<uint8_t*>(target->backing_store());
   CopyBytes(target_data, source_data + start, target_length);