Reviewers: rossberg,
Description:
Perform HasFastProperties check on prototypes when computing call targets in
Crankshaft.
BUG=125148
TEST=mjsunit/regress/regress-crbug-125148
Please review this at https://chromiumcodereview.appspot.com/10735054/
SVN Base: https://v8.googlecode.com/svn/branches/bleeding_edge
Affected files:
M src/ast.cc
A + test/mjsunit/regress/regress-crbug-125148.js
Index: src/ast.cc
diff --git a/src/ast.cc b/src/ast.cc
index
07e50038f69b04507d0f6bb83fdd7afd9252f50e..9d18f6929eee0a47c446aaf26e16827fd10bb5ce
100644
--- a/src/ast.cc
+++ b/src/ast.cc
@@ -528,6 +528,7 @@ bool Call::ComputeTarget(Handle<Map> type,
Handle<String> name) {
if (!type->prototype()->IsJSObject()) return false;
// Go up the prototype chain, recording where we are currently.
holder_ = Handle<JSObject>(JSObject::cast(type->prototype()));
+ if (!holder_->HasFastProperties()) return false;
type = Handle<Map>(holder()->map());
}
}
Index: test/mjsunit/regress/regress-crbug-125148.js
diff --git a/test/mjsunit/regress/regress-2030.js
b/test/mjsunit/regress/regress-crbug-125148.js
similarity index 80%
copy from test/mjsunit/regress/regress-2030.js
copy to test/mjsunit/regress/regress-crbug-125148.js
index
fb5a3d0c4633e2350f6ff0185f13416248296c29..ed884652dd0eb90baf029fe3a8533c5b311446d2
100644
--- a/test/mjsunit/regress/regress-2030.js
+++ b/test/mjsunit/regress/regress-crbug-125148.js
@@ -25,29 +25,26 @@
// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
-// Flags: --allow-natives-syntax
-
-function a() {
- this.x = 1;
+var A = {
+ foo: function() { assertUnreachable(); }
}
-var aa = new a();
-%DebugPrint(aa);
-function b() {
- this.z = 23;
- this.x = 2;
+var B = {
+ b: 2,
+ foo: function() { return 1; }
}
-var bb = new b();
-%DebugPrint(bb);
+B.__proto__ = A;
+
+var C = {};
+C.__proto__ = B;
-function f(o) {
- return o.x;
+function bar(x) {
+ return x.foo();
}
-assertSame(1, f(aa));
-assertSame(1, f(aa));
-assertSame(2, f(bb));
-assertSame(2, f(bb));
-%OptimizeFunctionOnNextCall(f);
-assertSame(1, f(aa));
-assertSame(2, f(bb));
+for (var i = 0; i < 3; i++) {
+ assertEquals(1, bar(C));
+}
+%OptimizeObjectForAddingMultipleProperties(B, 100); // Force dictionary
mode.
+%OptimizeFunctionOnNextCall(bar);
+assertEquals(1, bar(C));
--
v8-dev mailing list
[email protected]
http://groups.google.com/group/v8-dev
