Reviewers: Jakob,
Message:
ptal
Description:
Remove broken optimization
Can't imagine it's very useful; lets restore/fix once it becomes relevant
BUG=
Please review this at https://codereview.chromium.org/1198253002/
Base URL: https://chromium.googlesource.com/v8/v8.git@master
Affected files (+8, -10 lines):
M src/accessors.cc
M test/mjsunit/array-length.js
Index: src/accessors.cc
diff --git a/src/accessors.cc b/src/accessors.cc
index
5743c7552f1ae7539dec267a87b3bdd6b5c705f5..9850cd388e416549ddd43e81672f9688c58728b3
100644
--- a/src/accessors.cc
+++ b/src/accessors.cc
@@ -193,16 +193,7 @@ static bool FastAsArrayLength(Isolate* isolate,
Handle<Object> value,
// We don't support AsArrayLength, so use AsArrayIndex for now. This just
// misses out on kMaxUInt32.
if (value->IsString()) return String::cast(*value)->AsArrayIndex(length);
- if (!value->IsJSValue()) return false;
- Handle<JSValue> wrapper = Handle<JSValue>::cast(value);
- DCHECK(wrapper->GetIsolate()
- ->native_context()
- ->number_function()
- ->has_initial_map());
- // Only support fast unwrapping for the initial map. Otherwise valueOf
might
- // have been overwritten, in which case unwrapping is invalid.
- if (wrapper->map() != isolate->number_function()->initial_map()) return
false;
- return wrapper->value()->ToArrayIndex(length);
+ return false;
}
Index: test/mjsunit/array-length.js
diff --git a/test/mjsunit/array-length.js b/test/mjsunit/array-length.js
index
04b1750a4a46023b15026000ff41caabac92125a..c2b325061bad562f53f27d22080e2d4430e32962
100644
--- a/test/mjsunit/array-length.js
+++ b/test/mjsunit/array-length.js
@@ -105,6 +105,13 @@ var a = new Array();
assertEquals(Object(12), a.length = new Number(12));
assertEquals(12, a.length);
+Number.prototype.valueOf = function() { return 10; }
+var n = new Number(100);
+assertEquals(n, a.length = n);
+assertEquals(10, a.length);
+n.valueOf = function() { return 20; }
+assertEquals(n, a.length = n);
+assertEquals(20, a.length);
var o = { length: -23 };
Array.prototype.pop.apply(o);
--
--
v8-dev mailing list
[email protected]
http://groups.google.com/group/v8-dev
---
You received this message because you are subscribed to the Google Groups "v8-dev" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
For more options, visit https://groups.google.com/d/optout.
