diff options
| author | Michal Klocek <michal.klocek@qt.io> | 2017-07-19 16:43:04 +0200 |
|---|---|---|
| committer | Michal Klocek <michal.klocek@qt.io> | 2017-07-31 11:46:22 +0000 |
| commit | cb094c05c5f06489fa64412e7f5d9e194a3f9495 (patch) | |
| tree | e4094007dc5cc240b6a599b4f6ae0d3a4ee4a5bf /chromium/v8/src | |
| parent | 9966a98c2c90603a7ed3c7bd61609d441b782116 (diff) | |
| download | qtwebengine-chromium-49-based.tar.gz | |
Fix broken debug build introduced in security backport49-based
Fix DCHECK to call HasSufficientCapacity instead of
HasSufficientCapacityToAdd (introduced in chromium's v8 a76d133f769).
Avoid right-shifting a negative integer in HasSufficientCapacity.
Change-Id: Id5370803896814f7536d7a026985b27e689c902e
Reviewed-by: Alexandru Croitor <alexandru.croitor@qt.io>
Diffstat (limited to 'chromium/v8/src')
| -rw-r--r-- | chromium/v8/src/objects.cc | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/chromium/v8/src/objects.cc b/chromium/v8/src/objects.cc index 9b463de1805..673a2192c27 100644 --- a/chromium/v8/src/objects.cc +++ b/chromium/v8/src/objects.cc @@ -17281,7 +17281,7 @@ bool HashTable<Derived, Shape, Key>::HasSufficientCapacity(int n) { // Return true if: // 50% is still free after adding n elements and // at most 50% of the free elements are deleted elements. - if (nod <= (capacity - nof) >> 1) { + if ((nof < capacity) && ((nod <= (capacity - nof) >> 1))) { int needed_free = nof >> 1; if (nof + needed_free <= capacity) return true; } @@ -18171,7 +18171,7 @@ Handle<Derived> Dictionary<Derived, Shape, Key>::NewEmpty( Isolate* isolate, PretenureFlag pretenure) { Handle<Derived> dict = DerivedHashTable::New(isolate, 1, pretenure); // Attempt to add one element to the empty dictionary must cause reallocation. - DCHECK(!dict->HasSufficientCapacityToAdd(1)); + DCHECK(!dict->HasSufficientCapacity(1)); // Initialize the next enumeration index. dict->SetNextEnumerationIndex(PropertyDetails::kInitialIndex); return dict; |