Author: [email protected]
Date: Wed Apr 22 04:54:55 2009
New Revision: 1765
Added:
trunk/test/mjsunit/regress/regress-317.js
Modified:
trunk/src/api.cc
trunk/src/objects.cc
trunk/src/string.js
trunk/test/mjsunit/string-replace.js
Log:
Push bleeding_edge r1758 and r1764 to trunk.
This fixes performance problem when using hidden values as well as a
String.prototype.replace problem that broke zillow.com.
Review URL: http://codereview.chromium.org/93012
Modified: trunk/src/api.cc
==============================================================================
--- trunk/src/api.cc (original)
+++ trunk/src/api.cc Wed Apr 22 04:54:55 2009
@@ -2373,7 +2373,7 @@
const char* v8::V8::GetVersion() {
- return "1.1.10.2";
+ return "1.1.10.3";
}
Modified: trunk/src/objects.cc
==============================================================================
--- trunk/src/objects.cc (original)
+++ trunk/src/objects.cc Wed Apr 22 04:54:55 2009
@@ -1145,9 +1145,10 @@
Object* JSObject::AddFastProperty(String* name,
Object* value,
PropertyAttributes attributes) {
- // Normalize the object if the name is not a real identifier.
+ // Normalize the object if the name is an actual string (not the
+ // hidden symbols) and is not a real identifier.
StringInputBuffer buffer(name);
- if (!Scanner::IsIdentifier(&buffer)) {
+ if (!Scanner::IsIdentifier(&buffer) && name != Heap::hidden_symbol()) {
Object* obj = NormalizeProperties(CLEAR_INOBJECT_PROPERTIES);
if (obj->IsFailure()) return obj;
return AddSlowProperty(name, value, attributes);
@@ -5175,19 +5176,15 @@
Object* JSObject::GetHiddenProperties(bool create_if_needed) {
String* key = Heap::hidden_symbol();
if (this->HasFastProperties()) {
- // If the object has fast properties, check whether the first slot in
the
- // descriptor array matches the hidden symbol. Since the hidden symbols
- // hash code is zero it will always occupy the first entry if present.
+ // If the object has fast properties, check whether the first slot
+ // in the descriptor array matches the hidden symbol. Since the
+ // hidden symbols hash code is zero (and no other string has hash
+ // code zero) it will always occupy the first entry if present.
DescriptorArray* descriptors = this->map()->instance_descriptors();
- if (descriptors->number_of_descriptors() > 0) {
- if (descriptors->GetKey(0) == key) {
-#ifdef DEBUG
- PropertyDetails details(descriptors->GetDetails(0));
- ASSERT(details.type() == FIELD);
-#endif // DEBUG
- Object* value = descriptors->GetValue(0);
- return FastPropertyAt(Descriptor::IndexFromValue(value));
- }
+ DescriptorReader r(descriptors);
+ if (!r.eos() && (r.GetKey() == key) && r.IsProperty()) {
+ ASSERT(r.type() == FIELD);
+ return FastPropertyAt(r.GetFieldIndex());
}
}
Modified: trunk/src/string.js
==============================================================================
--- trunk/src/string.js (original)
+++ trunk/src/string.js Wed Apr 22 04:54:55 2009
@@ -304,6 +304,8 @@
builder.add('$');
--position;
}
+ } else {
+ builder.add('$');
}
} else {
builder.add('$');
Added: trunk/test/mjsunit/regress/regress-317.js
==============================================================================
--- (empty file)
+++ trunk/test/mjsunit/regress/regress-317.js Wed Apr 22 04:54:55 2009
@@ -0,0 +1,31 @@
+// Copyright 2009 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Ensure replacement with string allows $ in replacement string.
+
+assertEquals("a$ec", "abc".replace("b", "$e"), "$e isn't meaningful");
+
Modified: trunk/test/mjsunit/string-replace.js
==============================================================================
--- trunk/test/mjsunit/string-replace.js (original)
+++ trunk/test/mjsunit/string-replace.js Wed Apr 22 04:54:55 2009
@@ -104,6 +104,15 @@
replaceTest("xax[$1]xcx", short, /b/g, "[$1]");
replaceTest("xax[]xcx", short, /b()/g, "[$1]");
+// Bug 317 look-alikes. If "$e" has no meaning, the "$" must be retained.
+replaceTest("xax$excx", short, "b", "$e");
+replaceTest("xax$excx", short, /b/, "$e");
+replaceTest("xax$excx", short, /b/g, "$e");
+
+replaceTest("xaxe$xcx", short, "b", "e$");
+replaceTest("xaxe$xcx", short, /b/, "e$");
+replaceTest("xaxe$xcx", short, /b/g, "e$");
+
replaceTest("[$$$1$$a1abb1bb0$002$3$03][$$$1$$b1bcc1cc0$002$3$03]c",
"abc",
/(.)(?=(.))/g, "[$$$$$$1$$$$$11$01$2$21$02$020$002$3$03]");
--~--~---------~--~----~------------~-------~--~----~
v8-dev mailing list
[email protected]
http://groups.google.com/group/v8-dev
-~----------~----~----~----~------~----~------~--~---
