From 5211824c9668ee9fae9854d7de32c7d94e04966c Mon Sep 17 00:00:00 2001 From: "hpayer@chromium.org" Date: Tue, 25 Feb 2014 15:47:33 +0000 Subject: [PATCH] Re-evaluate marking bits of a descriptor array when it gets replaced. BUG=340254 R=verwaest@chromium.org Review URL: https://codereview.chromium.org/179733004 git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@19546 ce2b1a6d-e550-0410-aec6-3dcde31c8c00 --- src/objects.cc | 3 +++ 1 file changed, 3 insertions(+) diff --git a/src/objects.cc b/src/objects.cc index 410292d..d2ad0b7 100644 --- a/src/objects.cc +++ b/src/objects.cc @@ -2579,6 +2579,7 @@ void Map::DeprecateTarget(Name* key, DescriptorArray* new_descriptors) { DescriptorArray* to_replace = instance_descriptors(); Map* current = this; + GetHeap()->incremental_marking()->RecordWrites(to_replace); while (current->instance_descriptors() == to_replace) { current->SetEnumLength(kInvalidEnumCacheSentinel); current->set_instance_descriptors(new_descriptors); @@ -6814,6 +6815,8 @@ MaybeObject* Map::ShareDescriptor(DescriptorArray* descriptors, Map* map; // Replace descriptors by new_descriptors in all maps that share it. + + GetHeap()->incremental_marking()->RecordWrites(descriptors); for (Object* current = GetBackPointer(); !current->IsUndefined(); current = map->GetBackPointer()) { -- 2.7.4