From f1ad20d059eeaaecf21fce45045b22369baafff2 Mon Sep 17 00:00:00 2001 From: "yangguo@chromium.org" Date: Thu, 27 Feb 2014 15:28:28 +0000 Subject: [PATCH] Fix bogus assertion. R=hpayer@chromium.org BUG=347530 Review URL: https://codereview.chromium.org/183243002 git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@19585 ce2b1a6d-e550-0410-aec6-3dcde31c8c00 --- src/objects.cc | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/src/objects.cc b/src/objects.cc index 59a5967..1d7c672 100644 --- a/src/objects.cc +++ b/src/objects.cc @@ -13089,8 +13089,9 @@ void JSObject::GetElementsCapacityAndUsage(int* capacity, int* used) { } // Fall through if packing is not guaranteed. case FAST_HOLEY_DOUBLE_ELEMENTS: { - FixedDoubleArray* elms = FixedDoubleArray::cast(elements()); - *capacity = elms->length(); + *capacity = elements()->length(); + if (*capacity == 0) break; + FixedDoubleArray * elms = FixedDoubleArray::cast(elements()); for (int i = 0; i < *capacity; i++) { if (!elms->is_the_hole(i)) ++(*used); } -- 2.7.4