Reviewers: Kevin Millikin, Description: Check holder before optimizing calls to global functions.
In the case where the function is not found in the global object, we have to generate a generic call. BUG=v8:1106 TEST=mjsunit/regress/regress-1106.js Please review this at http://codereview.chromium.org/6483010/ SVN Base: http://v8.googlecode.com/svn/branches/bleeding_edge/ Affected files: M src/ast.cc M test/mjsunit/regress/regress-1106.js Index: src/ast.cc =================================================================== --- src/ast.cc (revision 6724) +++ src/ast.cc (working copy) @@ -618,7 +618,9 @@ cell_ = Handle<JSGlobalPropertyCell>::null(); LookupResult lookup; global->Lookup(*name, &lookup); - if (lookup.IsProperty() && lookup.type() == NORMAL) { + if (lookup.IsProperty() && + lookup.type() == NORMAL && + lookup.holder() == *global) { cell_ = Handle<JSGlobalPropertyCell>(global->GetPropertyCell(&lookup)); if (cell_->value()->IsJSFunction()) { Handle<JSFunction> candidate(JSFunction::cast(cell_->value())); Index: test/mjsunit/regress/regress-1106.js =================================================================== --- test/mjsunit/regress/regress-1106.js (revision 6724) +++ test/mjsunit/regress/regress-1106.js (working copy) @@ -40,3 +40,11 @@ for (i=0 ; i < 100000; ++i) { assertEquals(5, f()); } + +// Test calls on functions defined in the prototype of the global object. +x.gee = function() { return 42; } +function g() { return gee(); } + +for (i=0 ; i < 100000; ++i) { + assertEquals(42, g()); +} -- v8-dev mailing list [email protected] http://groups.google.com/group/v8-dev
