Reviewers: Toon Verwaest,
Message:
PTAL
Description:
Map::CopyGeneralizeAllRepresentations() left incorrect layout descriptor in
a
new map.
BUG=chromium:436820
LOG=N
Please review this at https://codereview.chromium.org/759823004/
Base URL: https://chromium.googlesource.com/v8/v8.git@master
Affected files (+17, -10 lines):
M src/objects.cc
A + test/mjsunit/regress/regress-crbug-436820.js
Index: src/objects.cc
diff --git a/src/objects.cc b/src/objects.cc
index
82ff09b317970bd03f1cca12f1b8878f3ce719ed..40e93c62a14f4556bd1f3c417ae14b0b7273393a
100644
--- a/src/objects.cc
+++ b/src/objects.cc
@@ -2183,17 +2183,24 @@ Handle<Map>
Map::CopyGeneralizeAllRepresentations(Handle<Map> map,
PropertyAttributes
attributes,
const char* reason) {
Isolate* isolate = map->GetIsolate();
- Handle<Map> new_map = Copy(map, reason);
+ Handle<DescriptorArray> old_descriptors(map->instance_descriptors(),
isolate);
+ int number_of_own_descriptors = map->NumberOfOwnDescriptors();
+ Handle<DescriptorArray> descriptors =
+ DescriptorArray::CopyUpTo(old_descriptors,
number_of_own_descriptors);
- DescriptorArray* descriptors = new_map->instance_descriptors();
- int length = descriptors->number_of_descriptors();
- for (int i = 0; i < length; i++) {
+ for (int i = 0; i < number_of_own_descriptors; i++) {
descriptors->SetRepresentation(i, Representation::Tagged());
if (descriptors->GetDetails(i).type() == FIELD) {
descriptors->SetValue(i, HeapType::Any());
}
}
+ Handle<LayoutDescriptor> new_layout_descriptor(
+ LayoutDescriptor::FastPointerLayout(), isolate);
+ Handle<Map> new_map =
+ CopyReplaceDescriptors(map, descriptors, new_layout_descriptor,
+ OMIT_TRANSITION, MaybeHandle<Name>(), reason);
+
// Unless the instance is being migrated, ensure that modify_index is a
field.
PropertyDetails details = descriptors->GetDetails(modify_index);
if (store_mode == FORCE_FIELD &&
Index: test/mjsunit/regress/regress-crbug-436820.js
diff --git a/test/mjsunit/regress/regress-409533.js
b/test/mjsunit/regress/regress-crbug-436820.js
similarity index 61%
copy from test/mjsunit/regress/regress-409533.js
copy to test/mjsunit/regress/regress-crbug-436820.js
index
e51065e4bf43f8c8ca222c458c85a96f003996a2..eea386ce1854ab408f7d6fa1dd5c5682ddd24b71
100644
--- a/test/mjsunit/regress/regress-409533.js
+++ b/test/mjsunit/regress/regress-crbug-436820.js
@@ -4,10 +4,10 @@
// Flags: --allow-natives-syntax
-function f() {
- %_RegExpConstructResult(0, {}, {});
+function c(p) {
+ return {__proto__: p};
}
-f();
-f();
-%OptimizeFunctionOnNextCall(f);
-f();
+var p = {};
+var o = c(p);
+p.x = 0.6;
+Object.defineProperty(p, "x", { writable: false });
--
--
v8-dev mailing list
[email protected]
http://groups.google.com/group/v8-dev
---
You received this message because you are subscribed to the Google Groups "v8-dev" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
For more options, visit https://groups.google.com/d/optout.
