Reviewers: jarin,
Message:
PTAL
Description:
Fix loading non-configurable non-writable value from a constant with
mismatching
type feedback
BUG=
Please review this at https://codereview.chromium.org/534093003/
SVN Base: https://v8.googlecode.com/svn/branches/bleeding_edge
Affected files (+40, -5 lines):
M src/hydrogen.cc
M src/hydrogen-instructions.h
A test/mjsunit/regress/regress-inline-constant-load.js
Index: src/hydrogen-instructions.h
diff --git a/src/hydrogen-instructions.h b/src/hydrogen-instructions.h
index
d866630b19ad944c9deb4201bdc52eda49d310ee..451bff64162d5344651607827d2324c94b45931a
100644
--- a/src/hydrogen-instructions.h
+++ b/src/hydrogen-instructions.h
@@ -3491,6 +3491,14 @@ class HConstant FINAL : public
HTemplateInstruction<0> {
zone, context, value, representation));
}
+ virtual Handle<Map> GetMonomorphicJSObjectMap() {
+ Handle<Object> object = object_.handle();
+ if (object->IsHeapObject()) {
+ return v8::internal::handle(HeapObject::cast(*object)->map());
+ }
+ return Handle<Map>();
+ }
+
static HConstant* CreateAndInsertBefore(Zone* zone,
HValue* context,
int32_t value,
Index: src/hydrogen.cc
diff --git a/src/hydrogen.cc b/src/hydrogen.cc
index
169df22aa8293093add0c5275fb7343b00118c6e..3f6a75ecca3171e9a5f3b3d1617db3ae886fcdbb
100644
--- a/src/hydrogen.cc
+++ b/src/hydrogen.cc
@@ -5792,16 +5792,16 @@ HInstruction*
HOptimizedGraphBuilder::BuildLoadNamedField(
PropertyAccessInfo* info,
HValue* checked_object) {
// See if this is a load for an immutable property
- if (checked_object->ActualValue()->IsConstant() && info->IsReadOnly() &&
- !info->IsConfigurable()) {
+ if (checked_object->ActualValue()->IsConstant()) {
Handle<Object> object(
HConstant::cast(checked_object->ActualValue())->handle(isolate()));
if (object->IsJSObject()) {
LookupIterator it(object, info->name(),
LookupIterator::OWN_PROPERTY);
- Handle<Object> value = JSObject::GetDataProperty(&it);
- CHECK(it.IsFound());
- return New<HConstant>(value);
+ if (it.IsFound() && it.IsReadOnly() && !it.IsConfigurable()) {
+ Handle<Object> value = JSObject::GetDataProperty(&it);
+ return New<HConstant>(value);
+ }
}
}
Index: test/mjsunit/regress/regress-inline-constant-load.js
diff --git a/test/mjsunit/regress/regress-inline-constant-load.js
b/test/mjsunit/regress/regress-inline-constant-load.js
new file mode 100644
index
0000000000000000000000000000000000000000..303639c74f0840f8af6b69ff7b01e9f364716ebe
--- /dev/null
+++ b/test/mjsunit/regress/regress-inline-constant-load.js
@@ -0,0 +1,27 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+var o1 = {};
+var o2 = {};
+
+function foo(x) {
+ return x.bar;
+}
+
+Object.defineProperty(o1, "bar", {value:200});
+foo(o1);
+foo(o1);
+
+function f(b) {
+ var o = o2;
+ if (b) { return foo(o) }
+}
+
+f(false);
+%OptimizeFunctionOnNextCall(f);
+assertEquals(undefined, f(false));
+Object.defineProperty(o2, "bar", {value: 100});
+assertEquals(100, f(true));
--
--
v8-dev mailing list
[email protected]
http://groups.google.com/group/v8-dev
---
You received this message because you are subscribed to the Google Groups "v8-dev" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
For more options, visit https://groups.google.com/d/optout.
