Revision: 9448 Author: [email protected] Date: Tue Sep 27 04:16:39 2011 Log: Smi element fixes in Builtins.
[email protected] BUG=none TEST=dromaeo-object-array-array-deconstruction-pop doesn't regress Review URL: http://codereview.chromium.org/8054007 http://code.google.com/p/v8/source/detail?r=9448 Modified: /branches/bleeding_edge/src/builtins.cc ======================================= --- /branches/bleeding_edge/src/builtins.cc Thu Sep 22 10:12:41 2011 +++ /branches/bleeding_edge/src/builtins.cc Tue Sep 27 04:16:39 2011 @@ -660,7 +660,7 @@ int len = -1; if (receiver->IsJSArray()) { JSArray* array = JSArray::cast(receiver); - if (!array->HasFastElements() || + if (!array->HasFastTypeElements() || !IsJSArrayFastElementMovingAllowed(heap, array)) { return CallJsBuiltin(isolate, "ArraySlice", args); } @@ -676,7 +676,7 @@ bool is_arguments_object_with_fast_elements = receiver->IsJSObject() && JSObject::cast(receiver)->map() == arguments_map - && JSObject::cast(receiver)->HasFastElements(); + && JSObject::cast(receiver)->HasFastTypeElements(); if (!is_arguments_object_with_fast_elements) { return CallJsBuiltin(isolate, "ArraySlice", args); } @@ -963,7 +963,7 @@ int result_len = 0; for (int i = 0; i < n_arguments; i++) { Object* arg = args[i]; - if (!arg->IsJSArray() || !JSArray::cast(arg)->HasFastElements() + if (!arg->IsJSArray() || !JSArray::cast(arg)->HasFastTypeElements() || JSArray::cast(arg)->GetPrototype() != array_proto) { return CallJsBuiltin(isolate, "ArrayConcat", args); } -- v8-dev mailing list [email protected] http://groups.google.com/group/v8-dev
