Revision: 12053
Author: [email protected]
Date: Thu Jul 12 02:32:26 2012
Log: Perform HasFastProperties check on prototypes when computing call
targets in Crankshaft, part 2.
The previous fix was for "real" calls, this one is for getters. It is a bit
unfortunate that this has to be fixed twice: We should really break up
Call::ComputeTarget into a predicate and 1 or 2 getters, so code can be
reused.
The regression test has been modified a bit to make things more uniform.
Review URL: https://chromiumcodereview.appspot.com/10702164
http://code.google.com/p/v8/source/detail?r=12053
Modified:
/branches/bleeding_edge/src/hydrogen.cc
/branches/bleeding_edge/test/mjsunit/regress/regress-crbug-125148.js
=======================================
--- /branches/bleeding_edge/src/hydrogen.cc Wed Jul 11 09:17:02 2012
+++ /branches/bleeding_edge/src/hydrogen.cc Thu Jul 12 02:32:26 2012
@@ -5637,6 +5637,7 @@
LookupResult* lookup) {
while (map->prototype()->IsJSObject()) {
Handle<JSObject> holder(JSObject::cast(map->prototype()));
+ if (!holder->HasFastProperties()) break;
map = Handle<Map>(holder->map());
map->LookupDescriptor(*holder, *name, lookup);
if (lookup->IsFound()) return;
=======================================
--- /branches/bleeding_edge/test/mjsunit/regress/regress-crbug-125148.js
Wed Jul 11 07:45:47 2012
+++ /branches/bleeding_edge/test/mjsunit/regress/regress-crbug-125148.js
Thu Jul 12 02:32:26 2012
@@ -27,26 +27,42 @@
// Flags: --allow-natives-syntax
-var A = {
- foo: function() { assertUnreachable(); }
+function ToDictionaryMode(x) {
+ %OptimizeObjectForAddingMultipleProperties(x, 100);
}
-var B = {
- b: 2,
- foo: function() { return 1; }
-}
-B.__proto__ = A;
-
-var C = {};
-C.__proto__ = B;
-
-function bar(x) {
- return x.foo();
-}
-
-for (var i = 0; i < 3; i++) {
- assertEquals(1, bar(C));
-}
-%OptimizeObjectForAddingMultipleProperties(B, 100); // Force dictionary
mode.
+var A, B, C;
+
+// The initial bug report was about calling a know function...
+A = {};
+Object.defineProperty(A, "foo", { value: function() { assertUnreachable();
}});
+
+B = Object.create(A);
+Object.defineProperty(B, "foo", { value: function() { return 111; }});
+
+C = Object.create(B);
+
+function bar(x) { return x.foo(); }
+
+assertEquals(111, bar(C));
+assertEquals(111, bar(C));
+ToDictionaryMode(B);
%OptimizeFunctionOnNextCall(bar);
-assertEquals(1, bar(C));
+assertEquals(111, bar(C));
+
+// Although this was not in the initial bug report: The same for getters...
+A = {};
+Object.defineProperty(A, "baz", { get: function() { assertUnreachable();
}});
+
+B = Object.create(A);
+Object.defineProperty(B, "baz", { get: function() { return 111; }});
+
+C = Object.create(B);
+
+function boo(x) { return x.baz; }
+
+assertEquals(111, boo(C));
+assertEquals(111, boo(C));
+ToDictionaryMode(B);
+%OptimizeFunctionOnNextCall(boo);
+assertEquals(111, boo(C));
--
v8-dev mailing list
[email protected]
http://groups.google.com/group/v8-dev
