Reviewers: Mads Ager, Kasper Lund, Lasse Reichstein,
Message:
Guys,
sorry for a long list, I just would like to see that committed asap.
Description:
Bring r4503 to the 2.1 branch.
Current custom call generators cannot cope with the case when receiver is
not a
JSArray.
Add a support for bailout from custom call generators (just return
undefined).
BUG=684,42802
Please review this at http://codereview.chromium.org/1774015/show
SVN Base: http://v8.googlecode.com/svn/branches/2.1/
Affected files:
M src/ia32/stub-cache-ia32.cc
M src/version.cc
M test/mjsunit/array-pop.js
M test/mjsunit/array-push.js
Index: test/mjsunit/array-pop.js
===================================================================
--- test/mjsunit/array-pop.js (revision 4551)
+++ test/mjsunit/array-pop.js (working copy)
@@ -59,3 +59,14 @@
assertEquals(0, a.length, "length 9th pop");
}
})();
+
+// Test the case of not JSArray receiver.
+// Regression test for custom call generators, see issue 684.
+(function() {
+ var a = [];
+ for (var i = 0; i < 100; i++) a.push(i);
+ var x = {__proto__: a};
+ for (var i = 0; i < 100; i++) {
+ assertEquals(99 - i, x.pop(), i + 'th iteration');
+ }
+})();
Index: test/mjsunit/array-push.js
===================================================================
--- test/mjsunit/array-push.js (revision 4551)
+++ test/mjsunit/array-push.js (working copy)
@@ -103,3 +103,13 @@
assertEquals(29, a.push(29));
}
})();
+
+// Test the case of not JSArray receiver.
+// Regression test for custom call generators, see issue 684.
+(function() {
+ var x = {__proto__: []};
+ for (var i = 0; i < 100; i++) {
+ x.push("a");
+ assertEquals(i + 1, x.length, i + 'th iteration');
+ }
+})();
Index: src/ia32/stub-cache-ia32.cc
===================================================================
--- src/ia32/stub-cache-ia32.cc (revision 4551)
+++ src/ia32/stub-cache-ia32.cc (working copy)
@@ -1223,6 +1223,11 @@
// -----------------------------------
ASSERT(check == RECEIVER_MAP_CHECK);
+ // If object is not an array, bail out to regular call.
+ if (!object->IsJSArray()) {
+ return Heap::undefined_value();
+ }
+
Label miss;
// Get the receiver from the stack.
@@ -1371,6 +1376,11 @@
// -----------------------------------
ASSERT(check == RECEIVER_MAP_CHECK);
+ // If object is not an array, bail out to regular call.
+ if (!object->IsJSArray()) {
+ return Heap::undefined_value();
+ }
+
Label miss, empty_array, call_builtin;
// Get the receiver from the stack.
@@ -1458,7 +1468,11 @@
if (function_info->HasCustomCallGenerator()) {
CustomCallGenerator generator =
ToCData<CustomCallGenerator>(function_info->function_data());
- return generator(this, object, holder, function, name, check);
+ Object* result = generator(this, object, holder, function, name,
check);
+ // undefined means bail out to regular compiler.
+ if (!result->IsUndefined()) {
+ return result;
+ }
}
Label miss_in_smi_check;
Index: src/version.cc
===================================================================
--- src/version.cc (revision 4551)
+++ src/version.cc (working copy)
@@ -35,7 +35,7 @@
#define MAJOR_VERSION 2
#define MINOR_VERSION 1
#define BUILD_NUMBER 10
-#define PATCH_LEVEL 11
+#define PATCH_LEVEL 12
#define CANDIDATE_VERSION false
// Define SONAME to have the SCons build the put a specific SONAME into the
--
v8-dev mailing list
[email protected]
http://groups.google.com/group/v8-dev
