Reviewers: Michael Starzinger,
Message:
Could you take a look, please?
Description:
Fix manual allocation folding of RegExpConstructResult.
[email protected]
BUG=409533
LOG=N
Please review this at https://codereview.chromium.org/532453003/
SVN Base: https://v8.googlecode.com/svn/branches/bleeding_edge
Affected files (+6, -5 lines):
M src/hydrogen.cc
A + test/mjsunit/regress/regress-409533.js
Index: src/hydrogen.cc
diff --git a/src/hydrogen.cc b/src/hydrogen.cc
index
5b2982b2a1491bbba7cc3109071664149ada217e..b15de89dce4dbdae376572d16da0e921560c0652
100644
--- a/src/hydrogen.cc
+++ b/src/hydrogen.cc
@@ -1855,9 +1855,11 @@ HValue*
HGraphBuilder::BuildRegExpConstructResult(HValue* length,
HAllocate* elements = BuildAllocateElements(elements_kind, size);
BuildInitializeElementsHeader(elements, elements_kind, length);
- HConstant* size_in_bytes_upper_bound = EstablishElementsAllocationSize(
- elements_kind, max_length->Integer32Value());
- elements->set_size_upper_bound(size_in_bytes_upper_bound);
+ if (!elements->has_size_upper_bound()) {
+ HConstant* size_in_bytes_upper_bound = EstablishElementsAllocationSize(
+ elements_kind, max_length->Integer32Value());
+ elements->set_size_upper_bound(size_in_bytes_upper_bound);
+ }
Add<HStoreNamedField>(
result, HObjectAccess::ForJSArrayOffset(JSArray::kElementsOffset),
Index: test/mjsunit/regress/regress-409533.js
diff --git a/test/mjsunit/regress/regress-crbug-387636.js
b/test/mjsunit/regress/regress-409533.js
similarity index 87%
copy from test/mjsunit/regress/regress-crbug-387636.js
copy to test/mjsunit/regress/regress-409533.js
index
1e50ace45a293c8561042f1a09c8fcd505b43dc2..e51065e4bf43f8c8ca222c458c85a96f003996a2
100644
--- a/test/mjsunit/regress/regress-crbug-387636.js
+++ b/test/mjsunit/regress/regress-409533.js
@@ -5,9 +5,8 @@
// Flags: --allow-natives-syntax
function f() {
- [].indexOf(0x40000000);
+ %_RegExpConstructResult(0, {}, {});
}
-
f();
f();
%OptimizeFunctionOnNextCall(f);
--
--
v8-dev mailing list
[email protected]
http://groups.google.com/group/v8-dev
---
You received this message because you are subscribed to the Google Groups "v8-dev" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
For more options, visit https://groups.google.com/d/optout.
