Reviewers: mvstanton,
Message:
PTAL
Description:
Ensure we don't try to inline raw access to indexed interceptor receivers.
BUG=chromium:419220
Please review this at https://codereview.chromium.org/697643002/
Base URL: https://v8.googlecode.com/svn/branches/bleeding_edge
Affected files (+10, -4 lines):
M src/hydrogen.cc
Index: src/hydrogen.cc
diff --git a/src/hydrogen.cc b/src/hydrogen.cc
index
d058ae0a59ecc473a97a28a47e0a297aa2596c09..c3e7613440d04d2bef8d66d465f257d50d2311ad
100644
--- a/src/hydrogen.cc
+++ b/src/hydrogen.cc
@@ -6941,6 +6941,12 @@ HInstruction*
HOptimizedGraphBuilder::BuildMonomorphicElementAccess(
}
+static bool CanInlineElementAccess(Handle<Map> map) {
+ return map->IsJSObjectMap() && !map->has_slow_elements_kind() &&
+ !map->has_indexed_interceptor();
+}
+
+
HInstruction* HOptimizedGraphBuilder::TryBuildConsolidatedElementLoad(
HValue* object,
HValue* key,
@@ -6958,7 +6964,7 @@ HInstruction*
HOptimizedGraphBuilder::TryBuildConsolidatedElementLoad(
Handle<Map> most_general_consolidated_map;
for (int i = 0; i < maps->length(); ++i) {
Handle<Map> map = maps->at(i);
- if (!map->IsJSObjectMap()) return NULL;
+ if (!CanInlineElementAccess(map)) return NULL;
// Don't allow mixing of JSArrays with JSObjects.
if (map->instance_type() == JS_ARRAY_TYPE) {
if (has_non_js_array_access) return NULL;
@@ -6976,6 +6982,7 @@ HInstruction*
HOptimizedGraphBuilder::TryBuildConsolidatedElementLoad(
if (has_double_maps) return NULL;
has_smi_or_object_maps = true;
} else {
+ UNREACHABLE();
return NULL;
}
// Remember if we've ever seen holey elements.
@@ -7077,8 +7084,7 @@ HValue*
HOptimizedGraphBuilder::HandlePolymorphicElementAccess(
if (untransitionable_maps.length() == 1) {
Handle<Map> untransitionable_map = untransitionable_maps[0];
HInstruction* instr = NULL;
- if (untransitionable_map->has_slow_elements_kind() ||
- !untransitionable_map->IsJSObjectMap()) {
+ if (!CanInlineElementAccess(untransitionable_map)) {
instr = AddInstruction(BuildKeyedGeneric(access_type, expr, object,
key,
val));
} else {
@@ -7215,7 +7221,7 @@ HValue*
HOptimizedGraphBuilder::HandleKeyedElementAccess(
if (monomorphic) {
Handle<Map> map = types->first();
- if (map->has_slow_elements_kind() || !map->IsJSObjectMap()) {
+ if (!CanInlineElementAccess(map)) {
instr = AddInstruction(BuildKeyedGeneric(access_type, expr, obj, key,
val));
} else {
--
--
v8-dev mailing list
[email protected]
http://groups.google.com/group/v8-dev
---
You received this message because you are subscribed to the Google Groups "v8-dev" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
For more options, visit https://groups.google.com/d/optout.
