http://codereview.chromium.org/1722003/diff/23001/24013 File src/ic.cc (right):
http://codereview.chromium.org/1722003/diff/23001/24013#newcode619 src/ic.cc:619: JSFunction::cast(*object)->should_have_prototype()) { On 2010/04/26 16:32:43, antonm wrote:
why this change? can LoadIC_FunctionPrototype cope with
prototype-less
functions?
LoadIC_FunctionPrototype will always miss, since the function doesn't have initial_map. Also, special accessor is used here (in return statement), which should not be used. http://codereview.chromium.org/1722003/diff/23001/24003 File src/objects.cc (right): http://codereview.chromium.org/1722003/diff/23001/24003#newcode4936 src/objects.cc:4936: ASSERT(map() == context()->global_context()->function_map()); On 2010/04/26 16:32:43, antonm wrote:
why we're sure map() will always identical to function_map()? Is it
possible to
invoke this method after we changed somehow function's map (say,
assigned a
property to it)?
This method is only invoked for JS builtins, which have initial function maps. I'm not sure whether it's reasonable to work in the other case, since there is no such usage. http://codereview.chromium.org/1722003/diff/23001/24005 File src/runtime.cc (right): http://codereview.chromium.org/1722003/diff/23001/24005#newcode6558 src/runtime.cc:6558: // case generated code bailouts here, since function has not initial_map. On 2010/04/26 16:32:43, antonm wrote:
has /no/ initial_map
Done. http://codereview.chromium.org/1722003/show -- v8-dev mailing list [email protected] http://groups.google.com/group/v8-dev
