Reviewers: Erik Corry,
Description:
Merged r11800 into trunk branch.
Fix performance regression caused by r11202.
[email protected]
BUG=v8:2156,v8:2034
TEST=mjsunit/regress/regress-2156,mjsunit/regress/regress-2034
Please review this at https://chromiumcodereview.appspot.com/10536171/
SVN Base: https://v8.googlecode.com/svn/trunk
Affected files:
M src/objects.h
M src/objects.cc
M src/version.cc
A + test/mjsunit/regress/regress-2156.js
Index: src/objects.cc
diff --git a/src/objects.cc b/src/objects.cc
index
d3e649247932c30b486ebd4d2a5f8aed070b0ad2..6314955b13749fbcc7abd71d535cc0225c9604f7
100644
--- a/src/objects.cc
+++ b/src/objects.cc
@@ -1720,11 +1720,13 @@ MaybeObject* JSObject::AddProperty(String* name,
Object* value,
PropertyAttributes attributes,
StrictModeFlag strict_mode,
- JSReceiver::StoreFromKeyed store_mode) {
+ JSReceiver::StoreFromKeyed store_mode,
+ ExtensibilityCheck extensibility_check)
{
ASSERT(!IsJSGlobalProxy());
Map* map_of_this = map();
Heap* heap = GetHeap();
- if (!map_of_this->is_extensible()) {
+ if (extensibility_check == PERFORM_EXTENSIBILITY_CHECK &&
+ !map_of_this->is_extensible()) {
if (strict_mode == kNonStrictMode) {
return value;
} else {
@@ -1763,7 +1765,8 @@ MaybeObject* JSObject::SetPropertyPostInterceptor(
String* name,
Object* value,
PropertyAttributes attributes,
- StrictModeFlag strict_mode) {
+ StrictModeFlag strict_mode,
+ ExtensibilityCheck extensibility_check) {
// Check local property, ignore interceptor.
LookupResult result(GetIsolate());
LocalLookupRealNamedProperty(name, &result);
@@ -1778,7 +1781,8 @@ MaybeObject* JSObject::SetPropertyPostInterceptor(
SetPropertyViaPrototypes(name, value, attributes, strict_mode,
&done);
if (done) return result_object;
// Add a new real property.
- return AddProperty(name, value, attributes, strict_mode);
+ return AddProperty(name, value, attributes, strict_mode,
+ MAY_BE_STORE_FROM_KEYED, extensibility_check);
}
@@ -1935,7 +1939,8 @@ MaybeObject* JSObject::SetPropertyWithInterceptor(
this_handle->SetPropertyPostInterceptor(*name_handle,
*value_handle,
attributes,
- strict_mode);
+ strict_mode,
+ PERFORM_EXTENSIBILITY_CHECK);
RETURN_IF_SCHEDULED_EXCEPTION(isolate);
return raw_result;
}
@@ -3664,11 +3669,14 @@ MaybeObject*
JSObject::GetHiddenPropertiesDictionary(bool create_if_absent) {
MaybeObject* dict_alloc = StringDictionary::Allocate(kInitialSize);
StringDictionary* dictionary;
if (!dict_alloc->To<StringDictionary>(&dictionary)) return dict_alloc;
- // Using AddProperty or SetPropertyPostInterceptor here could fail,
because
- // object might be non-extensible.
- return HasFastProperties()
- ? AddFastProperty(GetHeap()->hidden_symbol(), dictionary, DONT_ENUM)
- : AddSlowProperty(GetHeap()->hidden_symbol(), dictionary, DONT_ENUM);
+ MaybeObject* store_result =
+ SetPropertyPostInterceptor(GetHeap()->hidden_symbol(),
+ dictionary,
+ DONT_ENUM,
+ kNonStrictMode,
+ OMIT_EXTENSIBILITY_CHECK);
+ if (store_result->IsFailure()) return store_result;
+ return dictionary;
}
@@ -3697,7 +3705,8 @@ MaybeObject* JSObject::SetHiddenPropertiesDictionary(
SetPropertyPostInterceptor(GetHeap()->hidden_symbol(),
dictionary,
DONT_ENUM,
- kNonStrictMode);
+ kNonStrictMode,
+ OMIT_EXTENSIBILITY_CHECK);
if (store_result->IsFailure()) return store_result;
return this;
}
Index: src/objects.h
diff --git a/src/objects.h b/src/objects.h
index
9aac37fcce7fb13191ba689d50f16477e1b03c37..15ecdd1412c5e10a3a0fd564e3aa55c4f2a56633
100644
--- a/src/objects.h
+++ b/src/objects.h
@@ -1369,6 +1369,13 @@ class JSReceiver: public HeapObject {
CERTAINLY_NOT_STORE_FROM_KEYED
};
+ // Internal properties (e.g. the hidden properties dictionary) might
+ // be added even though the receiver is non-extensible.
+ enum ExtensibilityCheck {
+ PERFORM_EXTENSIBILITY_CHECK,
+ OMIT_EXTENSIBILITY_CHECK
+ };
+
// Casting.
static inline JSReceiver* cast(Object* obj);
@@ -1567,7 +1574,8 @@ class JSObject: public JSReceiver {
String* name,
Object* value,
PropertyAttributes attributes,
- StrictModeFlag strict_mode);
+ StrictModeFlag strict_mode,
+ ExtensibilityCheck extensibility_check);
static Handle<Object> SetLocalPropertyIgnoreAttributes(
Handle<JSObject> object,
@@ -1959,7 +1967,8 @@ class JSObject: public JSReceiver {
Object* value,
PropertyAttributes attributes,
StrictModeFlag strict_mode,
- StoreFromKeyed store_mode = MAY_BE_STORE_FROM_KEYED);
+ StoreFromKeyed store_mode = MAY_BE_STORE_FROM_KEYED,
+ ExtensibilityCheck extensibility_check =
PERFORM_EXTENSIBILITY_CHECK);
// Convert the object to use the canonical dictionary
// representation. If the object is expected to have additional
properties
Index: src/version.cc
diff --git a/src/version.cc b/src/version.cc
index
4fdd2e593af8176c02f37ec037b9cf1dad3777ac..81b2c597ea9f239f7fcc8c3150b08ba9bf3a0452
100644
--- a/src/version.cc
+++ b/src/version.cc
@@ -35,7 +35,7 @@
#define MAJOR_VERSION 3
#define MINOR_VERSION 11
#define BUILD_NUMBER 10
-#define PATCH_LEVEL 1
+#define PATCH_LEVEL 2
// Use 1 for candidates and 0 otherwise.
// (Boolean macro values are not supported by all preprocessors.)
#define IS_CANDIDATE_VERSION 0
Index: test/mjsunit/regress/regress-2156.js
diff --git a/src/platform-posix.h b/test/mjsunit/regress/regress-2156.js
similarity index 81%
copy from src/platform-posix.h
copy to test/mjsunit/regress/regress-2156.js
index
7a982ed2ef3080dad77860d6f46b356a9067bf3b..348257113062b568770a072d86ed52b3e854d384
100644
--- a/src/platform-posix.h
+++ b/test/mjsunit/regress/regress-2156.js
@@ -25,15 +25,15 @@
// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
-#ifndef V8_PLATFORM_POSIX_H_
-#define V8_PLATFORM_POSIX_H_
+// Flags: --allow-natives-syntax --harmony-collections
-namespace v8 {
-namespace internal {
+var key1 = {};
+var key2 = {};
+var map = new WeakMap;
-// Used by platform implementation files during OS::PostSetUp().
-void POSIXPostSetUp();
-
-} } // namespace v8::internal
-
-#endif // V8_PLATFORM_POSIX_H_
+// Adding hidden properties preserves map sharing. Putting the key into
+// a WeakMap will cause the first hidden property to be added.
+assertTrue(%HaveSameMap(key1, key2));
+map.set(key1, 1);
+map.set(key2, 2);
+assertTrue(%HaveSameMap(key1, key2));
--
v8-dev mailing list
[email protected]
http://groups.google.com/group/v8-dev
