Revision: 23650
Author: [email protected]
Date: Wed Sep 3 12:13:46 2014 UTC
Log: Fix loading non-configurable non-writable value from a constant
with mismatching type feedback
BUG=410209
LOG=n
[email protected]
Review URL: https://codereview.chromium.org/534093003
https://code.google.com/p/v8/source/detail?r=23650
Added:
/branches/bleeding_edge/test/mjsunit/regress/regress-inline-constant-load.js
Modified:
/branches/bleeding_edge/src/hydrogen-instructions.h
/branches/bleeding_edge/src/hydrogen.cc
=======================================
--- /dev/null
+++
/branches/bleeding_edge/test/mjsunit/regress/regress-inline-constant-load.js
Wed Sep 3 12:13:46 2014 UTC
@@ -0,0 +1,27 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+var o1 = {};
+var o2 = {};
+
+function foo(x) {
+ return x.bar;
+}
+
+Object.defineProperty(o1, "bar", {value:200});
+foo(o1);
+foo(o1);
+
+function f(b) {
+ var o = o2;
+ if (b) { return foo(o) }
+}
+
+f(false);
+%OptimizeFunctionOnNextCall(f);
+assertEquals(undefined, f(false));
+Object.defineProperty(o2, "bar", {value: 100});
+assertEquals(100, f(true));
=======================================
--- /branches/bleeding_edge/src/hydrogen-instructions.h Wed Sep 3 10:51:51
2014 UTC
+++ /branches/bleeding_edge/src/hydrogen-instructions.h Wed Sep 3 12:13:46
2014 UTC
@@ -3490,6 +3490,14 @@
return instruction->Append(HConstant::New(
zone, context, value, representation));
}
+
+ virtual Handle<Map> GetMonomorphicJSObjectMap() OVERRIDE {
+ Handle<Object> object = object_.handle();
+ if (object->IsHeapObject()) {
+ return v8::internal::handle(HeapObject::cast(*object)->map());
+ }
+ return Handle<Map>();
+ }
static HConstant* CreateAndInsertBefore(Zone* zone,
HValue* context,
@@ -5512,7 +5520,7 @@
}
}
- virtual Handle<Map> GetMonomorphicJSObjectMap() {
+ virtual Handle<Map> GetMonomorphicJSObjectMap() OVERRIDE {
return known_initial_map_;
}
=======================================
--- /branches/bleeding_edge/src/hydrogen.cc Wed Sep 3 10:51:51 2014 UTC
+++ /branches/bleeding_edge/src/hydrogen.cc Wed Sep 3 12:13:46 2014 UTC
@@ -5792,16 +5792,16 @@
PropertyAccessInfo* info,
HValue* checked_object) {
// See if this is a load for an immutable property
- if (checked_object->ActualValue()->IsConstant() && info->IsReadOnly() &&
- !info->IsConfigurable()) {
+ if (checked_object->ActualValue()->IsConstant()) {
Handle<Object> object(
HConstant::cast(checked_object->ActualValue())->handle(isolate()));
if (object->IsJSObject()) {
LookupIterator it(object, info->name(),
LookupIterator::OWN_PROPERTY);
Handle<Object> value = JSObject::GetDataProperty(&it);
- CHECK(it.IsFound());
- return New<HConstant>(value);
+ if (it.IsFound() && it.IsReadOnly() && !it.IsConfigurable()) {
+ return New<HConstant>(value);
+ }
}
}
--
--
v8-dev mailing list
[email protected]
http://groups.google.com/group/v8-dev
---
You received this message because you are subscribed to the Google Groups "v8-dev" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
For more options, visit https://groups.google.com/d/optout.
