Revision: 24438
Author: [email protected]
Date: Tue Oct 7 14:32:19 2014 UTC
Log: Fix for assertion failures appeared after StoreTransitionStub
implementation.
[email protected]
Review URL: https://codereview.chromium.org/637553002
https://code.google.com/p/v8/source/detail?r=24438
Modified:
/branches/bleeding_edge/src/code-stubs-hydrogen.cc
/branches/bleeding_edge/src/objects-debug.cc
=======================================
--- /branches/bleeding_edge/src/code-stubs-hydrogen.cc Thu Oct 2 07:04:28
2014 UTC
+++ /branches/bleeding_edge/src/code-stubs-hydrogen.cc Tue Oct 7 14:32:19
2014 UTC
@@ -800,12 +800,12 @@
BuildCopyProperties(properties, new_properties, length,
new_capacity);
- // Store the new value into the "extended" object.
Add<HStoreNamedField>(object, HObjectAccess::ForPropertiesPointer(),
new_properties);
}
// Fall through.
case StoreTransitionStub::StoreMapAndValue:
+ // Store the new value into the "extended" object.
BuildStoreNamedField(
object, GetParameter(StoreTransitionDescriptor::kValueIndex),
casted_stub()->index(), casted_stub()->representation(), true);
=======================================
--- /branches/bleeding_edge/src/objects-debug.cc Thu Sep 25 08:25:25 2014
UTC
+++ /branches/bleeding_edge/src/objects-debug.cc Tue Oct 7 14:32:19 2014
UTC
@@ -256,9 +256,17 @@
}
if (HasFastProperties()) {
- CHECK_EQ(map()->unused_property_fields(),
- (map()->inobject_properties() + properties()->length() -
- map()->NextFreePropertyIndex()));
+ int actual_unused_property_fields = map()->inobject_properties() +
+ properties()->length() -
+ map()->NextFreePropertyIndex();
+ if (map()->unused_property_fields() != actual_unused_property_fields) {
+ // This could actually happen in the middle of StoreTransitionStub
+ // when the new extended backing store is already set into the
object and
+ // the allocation of the MutableHeapNumber triggers GC (in this case
map
+ // is not updated yet).
+ CHECK_EQ(map()->unused_property_fields(),
+ actual_unused_property_fields - JSObject::kFieldsAdded);
+ }
DescriptorArray* descriptors = map()->instance_descriptors();
for (int i = 0; i < map()->NumberOfOwnDescriptors(); i++) {
if (descriptors->GetDetails(i).type() == FIELD) {
--
--
v8-dev mailing list
[email protected]
http://groups.google.com/group/v8-dev
---
You received this message because you are subscribed to the Google Groups "v8-dev" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
For more options, visit https://groups.google.com/d/optout.
