Revision: 23183
Author: [email protected]
Date: Tue Aug 19 08:35:39 2014 UTC
Log: Do not install fillers when right trimming large objects.
BUG=
[email protected]
Review URL: https://codereview.chromium.org/487703002
http://code.google.com/p/v8/source/detail?r=23183
Added:
/branches/bleeding_edge/test/mjsunit/regress/regress-404981.js
Modified:
/branches/bleeding_edge/src/heap/heap.cc
=======================================
--- /dev/null
+++ /branches/bleeding_edge/test/mjsunit/regress/regress-404981.js Tue Aug
19 08:35:39 2014 UTC
@@ -0,0 +1,6 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+var large_object = new Array(5000001);
+large_object.length = 23;
=======================================
--- /branches/bleeding_edge/src/heap/heap.cc Tue Aug 12 15:28:20 2014 UTC
+++ /branches/bleeding_edge/src/heap/heap.cc Tue Aug 19 08:35:39 2014 UTC
@@ -3321,7 +3321,6 @@
const int bytes_to_trim = elements_to_trim * element_size;
// For now this trick is only applied to objects in new and paged space.
- DCHECK(!lo_space()->Contains(object));
DCHECK(object->map() != fixed_cow_array_map());
const int len = object->length();
@@ -3333,7 +3332,12 @@
// Technically in new space this write might be omitted (except for
// debug mode which iterates through the heap), but to play safer
// we still do it.
- CreateFillerObjectAt(new_end, bytes_to_trim);
+ // We do not create a filler for objects in large object space.
+ // TODO(hpayer): We should shrink the large object page if the size
+ // of the object changed significantly.
+ if (!lo_space()->Contains(object)) {
+ CreateFillerObjectAt(new_end, bytes_to_trim);
+ }
// Initialize header of the trimmed array. We are storing the new length
// using release store after creating a filler for the left-over space to
--
--
v8-dev mailing list
[email protected]
http://groups.google.com/group/v8-dev
---
You received this message because you are subscribed to the Google Groups "v8-dev" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
For more options, visit https://groups.google.com/d/optout.
