Revision: 25028
Author: [email protected]
Date: Fri Oct 31 09:21:54 2014 UTC
Log: Ensure we don't try to inline raw access to indexed interceptor
receivers.
BUG=chromium:419220
LOG=y
[email protected]
Review URL: https://codereview.chromium.org/697643002
https://code.google.com/p/v8/source/detail?r=25028
Modified:
/branches/bleeding_edge/src/hydrogen.cc
=======================================
--- /branches/bleeding_edge/src/hydrogen.cc Tue Oct 28 13:23:54 2014 UTC
+++ /branches/bleeding_edge/src/hydrogen.cc Fri Oct 31 09:21:54 2014 UTC
@@ -6939,6 +6939,12 @@
map->elements_kind(), access_type,
load_mode, store_mode);
}
+
+
+static bool CanInlineElementAccess(Handle<Map> map) {
+ return map->IsJSObjectMap() && !map->has_slow_elements_kind() &&
+ !map->has_indexed_interceptor();
+}
HInstruction* HOptimizedGraphBuilder::TryBuildConsolidatedElementLoad(
@@ -6958,7 +6964,7 @@
Handle<Map> most_general_consolidated_map;
for (int i = 0; i < maps->length(); ++i) {
Handle<Map> map = maps->at(i);
- if (!map->IsJSObjectMap()) return NULL;
+ if (!CanInlineElementAccess(map)) return NULL;
// Don't allow mixing of JSArrays with JSObjects.
if (map->instance_type() == JS_ARRAY_TYPE) {
if (has_non_js_array_access) return NULL;
@@ -7036,7 +7042,7 @@
Handle<Map> map = maps->at(i);
DCHECK(!map->IsStringMap());
ElementsKind elements_kind = map->elements_kind();
- if (IsFastElementsKind(elements_kind) &&
+ if (CanInlineElementAccess(map) && IsFastElementsKind(elements_kind) &&
elements_kind != GetInitialFastElementsKind()) {
possible_transitioned_maps.Add(map);
}
@@ -7077,8 +7083,7 @@
if (untransitionable_maps.length() == 1) {
Handle<Map> untransitionable_map = untransitionable_maps[0];
HInstruction* instr = NULL;
- if (untransitionable_map->has_slow_elements_kind() ||
- !untransitionable_map->IsJSObjectMap()) {
+ if (!CanInlineElementAccess(untransitionable_map)) {
instr = AddInstruction(BuildKeyedGeneric(access_type, expr, object,
key,
val));
} else {
@@ -7094,7 +7099,6 @@
for (int i = 0; i < untransitionable_maps.length(); ++i) {
Handle<Map> map = untransitionable_maps[i];
- if (!map->IsJSObjectMap()) continue;
ElementsKind elements_kind = map->elements_kind();
HBasicBlock* this_map = graph()->CreateBasicBlock();
HBasicBlock* other_map = graph()->CreateBasicBlock();
@@ -7104,7 +7108,7 @@
set_current_block(this_map);
HInstruction* access = NULL;
- if (IsDictionaryElementsKind(elements_kind)) {
+ if (!CanInlineElementAccess(map)) {
access = AddInstruction(BuildKeyedGeneric(access_type, expr, object,
key,
val));
} else {
@@ -7215,7 +7219,7 @@
if (monomorphic) {
Handle<Map> map = types->first();
- if (map->has_slow_elements_kind() || !map->IsJSObjectMap()) {
+ if (!CanInlineElementAccess(map)) {
instr = AddInstruction(BuildKeyedGeneric(access_type, expr, obj, key,
val));
} else {
--
--
v8-dev mailing list
[email protected]
http://groups.google.com/group/v8-dev
---
You received this message because you are subscribed to the Google Groups "v8-dev" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
For more options, visit https://groups.google.com/d/optout.
