From: verwaest@chromium.org <verwaest@chromium.org@ce2b1a6d-e550-0410-aec6-3dcde31c8c00>
Date: Mon, 10 Jun 2013 11:27:09 +0000 (+0000)
Subject: Lookup transition again after migrating a transition target.
X-Git-Tag: upstream/4.7.83~13936
X-Git-Url: http://review.tizen.org/git/?a=commitdiff_plain;h=dbb16eaec3816056ac966bb83e5e782a752646dc;p=platform%2Fupstream%2Fv8.git

Lookup transition again after migrating a transition target.
R=ulan@chromium.org
BUG=chromium:242332

Review URL: https://chromiumcodereview.appspot.com/16347005

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@15031 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
---

diff --git a/src/ic.cc b/src/ic.cc
index ef8ab8a..db1cb95 100644
--- a/src/ic.cc
+++ b/src/ic.cc
@@ -1541,6 +1541,10 @@ static bool LookupForWrite(Handle<JSObject> receiver,
     Handle<Map> target(lookup->GetTransitionMapFromMap(receiver->map()));
     Map::GeneralizeRepresentation(
         target, target->LastAdded(), value->OptimalRepresentation());
+    // Lookup the transition again since the transition tree may have changed
+    // entirely by the migration above.
+    receiver->map()->LookupTransition(*holder, *name, lookup);
+    if (!lookup->IsTransition()) return false;
     *state = MONOMORPHIC_PROTOTYPE_FAILURE;
   }
   return true;