Reviewers: Yang,
Message:
PTAL
Description:
Fix for assertion failures appeared after StoreTransitionStub
implementation.
Please review this at https://codereview.chromium.org/637553002/
SVN Base: https://v8.googlecode.com/svn/branches/bleeding_edge
Affected files (+12, -4 lines):
M src/code-stubs-hydrogen.cc
M src/objects-debug.cc
Index: src/code-stubs-hydrogen.cc
diff --git a/src/code-stubs-hydrogen.cc b/src/code-stubs-hydrogen.cc
index
7515084583396223ebc945dcfd828378965ec3b3..80fff3f26237cd3941eee70bf70434b875299adc
100644
--- a/src/code-stubs-hydrogen.cc
+++ b/src/code-stubs-hydrogen.cc
@@ -800,12 +800,12 @@ HValue*
CodeStubGraphBuilder<StoreTransitionStub>::BuildCodeStub() {
BuildCopyProperties(properties, new_properties, length,
new_capacity);
- // Store the new value into the "extended" object.
Add<HStoreNamedField>(object, HObjectAccess::ForPropertiesPointer(),
new_properties);
}
// Fall through.
case StoreTransitionStub::StoreMapAndValue:
+ // Store the new value into the "extended" object.
BuildStoreNamedField(
object, GetParameter(StoreTransitionDescriptor::kValueIndex),
casted_stub()->index(), casted_stub()->representation(), true);
Index: src/objects-debug.cc
diff --git a/src/objects-debug.cc b/src/objects-debug.cc
index
1d5af5b9e706c3984373a4def4194f33cb3ee647..d9d5c056b163b6e2b21c48a1f61071147b1b4fd1
100644
--- a/src/objects-debug.cc
+++ b/src/objects-debug.cc
@@ -256,9 +256,17 @@ void JSObject::JSObjectVerify() {
}
if (HasFastProperties()) {
- CHECK_EQ(map()->unused_property_fields(),
- (map()->inobject_properties() + properties()->length() -
- map()->NextFreePropertyIndex()));
+ int actual_unused_property_fields = map()->inobject_properties() +
+ properties()->length() -
+ map()->NextFreePropertyIndex();
+ if (map()->unused_property_fields() != actual_unused_property_fields) {
+ // This could actually happen in the middle of StoreTransitionStub
+ // when the new extended backing store is already set into the
object and
+ // the allocation of the MutableHeapNumber triggers GC (in this case
map
+ // is not updated yet).
+ CHECK_EQ(map()->unused_property_fields(),
+ actual_unused_property_fields - JSObject::kFieldsAdded);
+ }
DescriptorArray* descriptors = map()->instance_descriptors();
for (int i = 0; i < map()->NumberOfOwnDescriptors(); i++) {
if (descriptors->GetDetails(i).type() == FIELD) {
--
--
v8-dev mailing list
[email protected]
http://groups.google.com/group/v8-dev
---
You received this message because you are subscribed to the Google Groups "v8-dev" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
For more options, visit https://groups.google.com/d/optout.
