Reviewers: Toon Verwaest,
Message:
PTAL.
Description:
Invalidate property cells for non-existent properties properly.
[email protected]
BUG=v8:3914
LOG=N
Please review this at https://codereview.chromium.org/945403008/
Base URL: https://chromium.googlesource.com/v8/v8.git@master
Affected files (+9, -7 lines):
M src/objects.cc
M test/cctest/cctest.status
Index: src/objects.cc
diff --git a/src/objects.cc b/src/objects.cc
index
542b8a0049df836c369b929146697540424c7244..baa1abdc516ba5515e971155ac70da399cfc77e4
100644
--- a/src/objects.cc
+++ b/src/objects.cc
@@ -15334,8 +15334,15 @@ void
GlobalObject::InvalidatePropertyCell(Handle<GlobalObject> global,
Handle<PropertyCell> new_cell =
isolate->factory()->NewPropertyCell(value);
global->property_dictionary()->ValueAtPut(entry, *new_cell);
- Handle<Object> hole =
global->GetIsolate()->factory()->the_hole_value();
- PropertyCell::SetValueInferType(cell, hole);
+ Handle<Object> hole = isolate->factory()->the_hole_value();
+ if (*hole != *value) {
+ PropertyCell::SetValueInferType(cell, hole);
+ } else {
+ // BUG3914: if property value was the hole, set it to any other
value,
+ // to ensure that LoadNonexistent ICs execute a miss.
+ Handle<Object> undefined = isolate->factory()->undefined_value();
+ PropertyCell::SetValueInferType(cell, undefined);
+ }
}
}
Index: test/cctest/cctest.status
diff --git a/test/cctest/cctest.status b/test/cctest/cctest.status
index
9dba97746315c34d2b9adb1d6a7a6db7d0db685c..1b43b931168eec50739ce5e785c919ed6d856975
100644
--- a/test/cctest/cctest.status
+++ b/test/cctest/cctest.status
@@ -98,11 +98,6 @@
# TODO(jochen): Reenable after we removed the CHECK() from the marking
queue.
'test-mark-compact/MarkingDeque': [SKIP],
- # BUG(3914).
- 'test-decls/CrossScriptStaticLookupUndeclared': [SKIP],
- 'test-decls/CrossScriptReferencesHarmony': [SKIP],
- 'test-decls/CrossScriptReferencesHarmonyRegress': [SKIP],
-
############################################################################
# Slow tests.
'test-api/Threading1': [PASS, ['mode == debug', SLOW]],
--
--
v8-dev mailing list
[email protected]
http://groups.google.com/group/v8-dev
---
You received this message because you are subscribed to the Google Groups "v8-dev" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
For more options, visit https://groups.google.com/d/optout.
