Revision: 4124
Author: [email protected]
Date: Fri Mar 12 14:18:18 2010
Log: Merge fix for crbug.com/37853 into the partial snapshots branch.
Review URL: http://codereview.chromium.org/882006
http://code.google.com/p/v8/source/detail?r=4124
Added:
/branches/experimental/partial_snapshots/test/mjsunit/regress/regress-crbug-37853.js
Modified:
/branches/experimental/partial_snapshots/src/ic.cc
/branches/experimental/partial_snapshots/src/objects.cc
/branches/experimental/partial_snapshots/src/objects.h
=======================================
--- /dev/null
+++
/branches/experimental/partial_snapshots/test/mjsunit/regress/regress-crbug-37853.js
Fri Mar 12 14:18:18 2010
@@ -0,0 +1,34 @@
+// Copyright 2009 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// See http://crbug.com/37853
+
+function f(o, k) { return o[k]; }
+a = {'a':1, 1:'a'}
+f(a, 'a')
+f(a, 'a')
+f(a, 1);
=======================================
--- /branches/experimental/partial_snapshots/src/ic.cc Fri Mar 12 13:59:11
2010
+++ /branches/experimental/partial_snapshots/src/ic.cc Fri Mar 12 14:18:18
2010
@@ -150,7 +150,7 @@
// the receiver map's code cache. Therefore, if the current target
// is in the receiver map's code cache, the inline cache failed due
// to prototype check failure.
- int index = map->IndexInCodeCache(String::cast(name), target);
+ int index = map->IndexInCodeCache(name, target);
if (index >= 0) {
// For keyed load/store, the most likely cause of cache failure is
// that the key has changed. We do not distinguish between
=======================================
--- /branches/experimental/partial_snapshots/src/objects.cc Fri Mar 12
13:59:11 2010
+++ /branches/experimental/partial_snapshots/src/objects.cc Fri Mar 12
14:18:18 2010
@@ -2988,7 +2988,7 @@
}
-int Map::IndexInCodeCache(String* name, Code* code) {
+int Map::IndexInCodeCache(Object* name, Code* code) {
// Get the internal index if a code cache exists.
if (!code_cache()->IsFixedArray()) {
return CodeCache::cast(code_cache())->GetIndex(name, code);
@@ -3133,12 +3133,11 @@
}
-int CodeCache::GetIndex(String* name, Code* code) {
- // This is not used for normal load/store/call IC's.
+int CodeCache::GetIndex(Object* name, Code* code) {
if (code->type() == NORMAL) {
if (normal_type_cache()->IsUndefined()) return -1;
CodeCacheHashTable* cache =
CodeCacheHashTable::cast(normal_type_cache());
- return cache->GetIndex(name, code->flags());
+ return cache->GetIndex(String::cast(name), code->flags());
}
FixedArray* array = default_cache();
@@ -3150,11 +3149,11 @@
}
-void CodeCache::RemoveByIndex(String* name, Code* code, int index) {
+void CodeCache::RemoveByIndex(Object* name, Code* code, int index) {
if (code->type() == NORMAL) {
ASSERT(!normal_type_cache()->IsUndefined());
CodeCacheHashTable* cache =
CodeCacheHashTable::cast(normal_type_cache());
- ASSERT(cache->GetIndex(name, code->flags()) == index);
+ ASSERT(cache->GetIndex(String::cast(name), code->flags()) == index);
cache->RemoveByIndex(index);
} else {
FixedArray* array = default_cache();
=======================================
--- /branches/experimental/partial_snapshots/src/objects.h Fri Mar 12
13:59:11 2010
+++ /branches/experimental/partial_snapshots/src/objects.h Fri Mar 12
14:18:18 2010
@@ -2941,7 +2941,7 @@
// Returns the non-negative index of the code object if it is in the
// cache and -1 otherwise.
- int IndexInCodeCache(String* name, Code* code);
+ int IndexInCodeCache(Object* name, Code* code);
// Removes a code object from the code cache at the given index.
void RemoveFromCodeCache(String* name, Code* code, int index);
@@ -3712,10 +3712,10 @@
// code object is not in that cache. This index can be used to later call
// RemoveByIndex. The cache cannot be modified between a call to
GetIndex and
// RemoveByIndex.
- int GetIndex(String* name, Code* code);
+ int GetIndex(Object* name, Code* code);
// Remove an object from the cache with the provided internal index.
- void RemoveByIndex(String* name, Code* code, int index);
+ void RemoveByIndex(Object* name, Code* code, int index);
static inline CodeCache* cast(Object* obj);
--
v8-dev mailing list
[email protected]
http://groups.google.com/group/v8-dev
