From: ishell@chromium.org <ishell@chromium.org>
Date: Wed, 18 Feb 2015 22:58:00 +0000 (+0100)
Subject: Fixed incorrect generalization of types in Map::ReconfigureProperty() introduced... 
X-Git-Tag: upstream/4.7.83~4309
X-Git-Url: http://review.tizen.org/git/?a=commitdiff_plain;h=b696572d4ffcbaed88ad31b948228385e874becb;p=platform%2Fupstream%2Fv8.git

Fixed incorrect generalization of types in Map::ReconfigureProperty() introduced in r26667.

BUG=chromium:459512
LOG=N
TBR=verwaest@chromium.org

Review URL: https://codereview.chromium.org/936253002

Cr-Commit-Position: refs/heads/master@{#26731}
---

diff --git a/src/objects.cc b/src/objects.cc
index fd35c90..1842bb6 100644
--- a/src/objects.cc
+++ b/src/objects.cc
@@ -2815,8 +2815,8 @@ Handle<Map> Map::ReconfigureProperty(Handle<Map> old_map, int modify_index,
             Handle<HeapType> old_field_type =
                 GetFieldType(isolate, old_descriptors, i,
                              old_details.location(), next_representation);
-            old_field_type =
-                GeneralizeFieldType(old_field_type, next_field_type, isolate);
+            next_field_type =
+                GeneralizeFieldType(next_field_type, old_field_type, isolate);
           }
         } else {
           Handle<HeapType> old_field_type =