From: ricow@chromium.org <ricow@chromium.org@ce2b1a6d-e550-0410-aec6-3dcde31c8c00>
Date: Wed, 16 Nov 2011 10:40:50 +0000 (+0000)
Subject: Use safe version (i.e. using write barrier) of set_map in ReinitializeJSReceiver.
X-Git-Tag: upstream/4.7.83~17902
X-Git-Url: http://review.tizen.org/git/?a=commitdiff_plain;h=22db7b1eaf03687c72251af53bee9f2494b37270;p=platform%2Fupstream%2Fv8.git

Use safe version (i.e. using write barrier) of set_map in ReinitializeJSReceiver.

We pass in the object that we set the map on.
Review URL: http://codereview.chromium.org/8486005

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10007 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
---

diff --git a/src/heap.cc b/src/heap.cc
index 0ecc286..cbf0cb3 100644
--- a/src/heap.cc
+++ b/src/heap.cc
@@ -3846,7 +3846,7 @@ MaybeObject* Heap::ReinitializeJSReceiver(
   // we must NOT fail after this point, where we have changed the type!
 
   // Reset the map for the object.
-  object->set_map_unsafe(map);
+  object->set_map(map);
   JSObject* jsobj = JSObject::cast(object);
 
   // Reinitialize the object from the constructor map.