Revision: 22671
Author: [email protected]
Date: Tue Jul 29 13:30:29 2014 UTC
Log: Fix Object.freeze with field type tracking.
Keep the descriptor properly intact while update the field type.
BUG=v8:3458
LOG=y
[email protected]
Review URL: https://codereview.chromium.org/424093002
http://code.google.com/p/v8/source/detail?r=22671
Added:
/branches/bleeding_edge/test/mjsunit/regress/regress-update-field-type-attributes.js
Modified:
/branches/bleeding_edge/src/objects.cc
/branches/bleeding_edge/src/objects.h
=======================================
--- /dev/null
+++
/branches/bleeding_edge/test/mjsunit/regress/regress-update-field-type-attributes.js
Tue Jul 29 13:30:29 2014 UTC
@@ -0,0 +1,12 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+function test(){
+ function InnerClass(){}
+ var container = {field: new InnerClass()};
+ return Object.freeze(container);
+};
+
+assertTrue(Object.isFrozen(test()));
+assertTrue(Object.isFrozen(test()));
=======================================
--- /branches/bleeding_edge/src/objects.cc Mon Jul 28 18:15:35 2014 UTC
+++ /branches/bleeding_edge/src/objects.cc Tue Jul 29 13:30:29 2014 UTC
@@ -2443,15 +2443,23 @@
}
-void Map::UpdateDescriptor(int descriptor_number, Descriptor* desc) {
+void Map::UpdateFieldType(int descriptor, Handle<Name> name,
+ Handle<HeapType> new_type) {
DisallowHeapAllocation no_allocation;
+ PropertyDetails details = instance_descriptors()->GetDetails(descriptor);
+ if (!details.type() == FIELD) return;
if (HasTransitionArray()) {
TransitionArray* transitions = this->transitions();
for (int i = 0; i < transitions->number_of_transitions(); ++i) {
- transitions->GetTarget(i)->UpdateDescriptor(descriptor_number, desc);
+ transitions->GetTarget(i)->UpdateFieldType(descriptor, name,
new_type);
}
}
- instance_descriptors()->Replace(descriptor_number, desc);;
+ // Skip if already updated the shared descriptor.
+ if (instance_descriptors()->GetFieldType(descriptor) == *new_type)
return;
+ FieldDescriptor d(name,
instance_descriptors()->GetFieldIndex(descriptor),
+ new_type, details.attributes(),
details.representation());
+ instance_descriptors()->Replace(descriptor, &d);
+ ;
}
@@ -2502,12 +2510,8 @@
old_field_type, new_field_type, isolate);
PropertyDetails details = descriptors->GetDetails(modify_index);
- FieldDescriptor d(handle(descriptors->GetKey(modify_index), isolate),
- descriptors->GetFieldIndex(modify_index),
- new_field_type,
- details.attributes(),
- details.representation());
- field_owner->UpdateDescriptor(modify_index, &d);
+ Handle<Name> name(descriptors->GetKey(modify_index));
+ field_owner->UpdateFieldType(modify_index, name, new_field_type);
field_owner->dependent_code()->DeoptimizeDependentCodeGroup(
isolate, DependentCode::kFieldTypeGroup);
=======================================
--- /branches/bleeding_edge/src/objects.h Tue Jul 29 11:34:08 2014 UTC
+++ /branches/bleeding_edge/src/objects.h Tue Jul 29 13:30:29 2014 UTC
@@ -6773,7 +6773,8 @@
Map* FindLastMatchMap(int verbatim, int length, DescriptorArray*
descriptors);
- void UpdateDescriptor(int descriptor_number, Descriptor* desc);
+ void UpdateFieldType(int descriptor_number, Handle<Name> name,
+ Handle<HeapType> new_type);
void PrintGeneralization(FILE* file,
const char* reason,
--
--
v8-dev mailing list
[email protected]
http://groups.google.com/group/v8-dev
---
You received this message because you are subscribed to the Google Groups "v8-dev" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
For more options, visit https://groups.google.com/d/optout.
