Revision: 4553
Author: [email protected]
Date: Fri Apr 30 02:21:54 2010
Log: Bring r4503 to the 2.1 branch.
Current custom call generators cannot cope with the case when receiver is
not a
JSArray.
Add a support for bailout from custom call generators (just return
undefined).
BUG=684,42802
Review URL: http://codereview.chromium.org/1774015
http://code.google.com/p/v8/source/detail?r=4553
Modified:
/branches/2.1/src/ia32/stub-cache-ia32.cc
/branches/2.1/src/version.cc
/branches/2.1/test/mjsunit/array-pop.js
/branches/2.1/test/mjsunit/array-push.js
=======================================
--- /branches/2.1/src/ia32/stub-cache-ia32.cc Fri Mar 26 02:27:16 2010
+++ /branches/2.1/src/ia32/stub-cache-ia32.cc Fri Apr 30 02:21:54 2010
@@ -1222,6 +1222,11 @@
// -- esp[(argc + 1) * 4] : receiver
// -----------------------------------
ASSERT(check == RECEIVER_MAP_CHECK);
+
+ // If object is not an array, bail out to regular call.
+ if (!object->IsJSArray()) {
+ return Heap::undefined_value();
+ }
Label miss;
@@ -1370,6 +1375,11 @@
// -- esp[(argc + 1) * 4] : receiver
// -----------------------------------
ASSERT(check == RECEIVER_MAP_CHECK);
+
+ // If object is not an array, bail out to regular call.
+ if (!object->IsJSArray()) {
+ return Heap::undefined_value();
+ }
Label miss, empty_array, call_builtin;
@@ -1458,7 +1468,11 @@
if (function_info->HasCustomCallGenerator()) {
CustomCallGenerator generator =
ToCData<CustomCallGenerator>(function_info->function_data());
- return generator(this, object, holder, function, name, check);
+ Object* result = generator(this, object, holder, function, name,
check);
+ // undefined means bail out to regular compiler.
+ if (!result->IsUndefined()) {
+ return result;
+ }
}
Label miss_in_smi_check;
=======================================
--- /branches/2.1/src/version.cc Tue Apr 27 13:29:25 2010
+++ /branches/2.1/src/version.cc Fri Apr 30 02:21:54 2010
@@ -35,7 +35,7 @@
#define MAJOR_VERSION 2
#define MINOR_VERSION 1
#define BUILD_NUMBER 10
-#define PATCH_LEVEL 11
+#define PATCH_LEVEL 12
#define CANDIDATE_VERSION false
// Define SONAME to have the SCons build the put a specific SONAME into the
=======================================
--- /branches/2.1/test/mjsunit/array-pop.js Mon Mar 15 03:26:20 2010
+++ /branches/2.1/test/mjsunit/array-pop.js Fri Apr 30 02:21:54 2010
@@ -59,3 +59,14 @@
assertEquals(0, a.length, "length 9th pop");
}
})();
+
+// Test the case of not JSArray receiver.
+// Regression test for custom call generators, see issue 684.
+(function() {
+ var a = [];
+ for (var i = 0; i < 100; i++) a.push(i);
+ var x = {__proto__: a};
+ for (var i = 0; i < 100; i++) {
+ assertEquals(99 - i, x.pop(), i + 'th iteration');
+ }
+})();
=======================================
--- /branches/2.1/test/mjsunit/array-push.js Wed Mar 17 06:18:24 2010
+++ /branches/2.1/test/mjsunit/array-push.js Fri Apr 30 02:21:54 2010
@@ -103,3 +103,13 @@
assertEquals(29, a.push(29));
}
})();
+
+// Test the case of not JSArray receiver.
+// Regression test for custom call generators, see issue 684.
+(function() {
+ var x = {__proto__: []};
+ for (var i = 0; i < 100; i++) {
+ x.push("a");
+ assertEquals(i + 1, x.length, i + 'th iteration');
+ }
+})();
--
v8-dev mailing list
[email protected]
http://groups.google.com/group/v8-dev
