Reviewers: Jakob,
Description:
Perform HasFastProperties check on prototypes when computing call targets in
Crankshaft, part 2.
The previous fix was for "real" calls, this one is for getters. It is a bit
unfortunate that this has to be fixed twice: We should really break up
Call::ComputeTarget into a predicate and 1 or 2 getters, so code can be
reused.
The regression test has been modified a bit to make things more uniform.
Please review this at http://codereview.chromium.org/10702164/
SVN Base: https://v8.googlecode.com/svn/branches/bleeding_edge
Affected files:
M src/hydrogen.cc
M test/mjsunit/regress/regress-crbug-125148.js
Index: src/hydrogen.cc
diff --git a/src/hydrogen.cc b/src/hydrogen.cc
index
009547c79fc401b94d6fbd8aa627067b6c04d827..2ba79b9bf5142e270acb0470ee5ea9b7f6d355fe
100644
--- a/src/hydrogen.cc
+++ b/src/hydrogen.cc
@@ -5637,6 +5637,7 @@ static void LookupInPrototypes(Handle<Map> map,
LookupResult* lookup) {
while (map->prototype()->IsJSObject()) {
Handle<JSObject> holder(JSObject::cast(map->prototype()));
+ if (!holder->HasFastProperties()) break;
map = Handle<Map>(holder->map());
map->LookupDescriptor(*holder, *name, lookup);
if (lookup->IsFound()) return;
Index: test/mjsunit/regress/regress-crbug-125148.js
diff --git a/test/mjsunit/regress/regress-crbug-125148.js
b/test/mjsunit/regress/regress-crbug-125148.js
index
025f9a5a4bd358cf71041254de202c4a28408e0d..142f14035c2f45dd53ce022893fe5649ee18aeb9
100644
--- a/test/mjsunit/regress/regress-crbug-125148.js
+++ b/test/mjsunit/regress/regress-crbug-125148.js
@@ -27,26 +27,42 @@
// Flags: --allow-natives-syntax
-var A = {
- foo: function() { assertUnreachable(); }
+function ToDictionaryMode(x) {
+ %OptimizeObjectForAddingMultipleProperties(x, 100);
}
-var B = {
- b: 2,
- foo: function() { return 1; }
-}
-B.__proto__ = A;
+var A, B, C;
-var C = {};
-C.__proto__ = B;
+// The initial bug report was about calling a know function...
+A = {};
+Object.defineProperty(A, "foo", { value: function() { assertUnreachable();
}});
-function bar(x) {
- return x.foo();
-}
+B = Object.create(A);
+Object.defineProperty(B, "foo", { value: function() { return 111; }});
-for (var i = 0; i < 3; i++) {
- assertEquals(1, bar(C));
-}
-%OptimizeObjectForAddingMultipleProperties(B, 100); // Force dictionary
mode.
+C = Object.create(B);
+
+function bar(x) { return x.foo(); }
+
+assertEquals(111, bar(C));
+assertEquals(111, bar(C));
+ToDictionaryMode(B);
%OptimizeFunctionOnNextCall(bar);
-assertEquals(1, bar(C));
+assertEquals(111, bar(C));
+
+// Although this was not in the initial bug report: The same for getters...
+A = {};
+Object.defineProperty(A, "baz", { get: function() { assertUnreachable();
}});
+
+B = Object.create(A);
+Object.defineProperty(B, "baz", { get: function() { return 111; }});
+
+C = Object.create(B);
+
+function boo(x) { return x.baz; }
+
+assertEquals(111, boo(C));
+assertEquals(111, boo(C));
+ToDictionaryMode(B);
+%OptimizeFunctionOnNextCall(boo);
+assertEquals(111, boo(C));
--
v8-dev mailing list
[email protected]
http://groups.google.com/group/v8-dev
