From 499ae77e18f49617bf4ab14b30405f1e5d031282 Mon Sep 17 00:00:00 2001 From: "verwaest@chromium.org" Date: Mon, 23 Jun 2014 10:35:58 +0000 Subject: [PATCH] Ensure the receiver for EnableAccessCheck is always a JSObject BUG= TBR=dcarney@chromium.org Review URL: https://codereview.chromium.org/349923005 git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@21929 ce2b1a6d-e550-0410-aec6-3dcde31c8c00 --- src/runtime.cc | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/src/runtime.cc b/src/runtime.cc index 42adde3..dcb41b3 100644 --- a/src/runtime.cc +++ b/src/runtime.cc @@ -2084,13 +2084,13 @@ RUNTIME_FUNCTION(Runtime_DisableAccessChecks) { RUNTIME_FUNCTION(Runtime_EnableAccessChecks) { HandleScope scope(isolate); ASSERT(args.length() == 1); - CONVERT_ARG_HANDLE_CHECKED(HeapObject, object, 0); + CONVERT_ARG_HANDLE_CHECKED(JSObject, object, 0); Handle old_map(object->map()); RUNTIME_ASSERT(!old_map->is_access_check_needed()); // Copy map so it won't interfere constructor's initial map. Handle new_map = Map::Copy(old_map); new_map->set_is_access_check_needed(true); - JSObject::MigrateToMap(Handle::cast(object), new_map); + JSObject::MigrateToMap(object, new_map); return isolate->heap()->undefined_value(); } -- 2.7.4