Reviewers: Toon Verwaest,
Message:
PTAL.
http://codereview.chromium.org/10802051/diff/2001/src/compiler.cc
File src/compiler.cc (right):
http://codereview.chromium.org/10802051/diff/2001/src/compiler.cc#newcode823
src/compiler.cc:823:
ASSERT(closure->IsMarkedForParallelRecompilation());
Sneaking in a small fix in here :)
Description:
Fix corner case when transforming dictionary to fast elements.
[email protected]
BUG=v8:2249
TEST=regress-2249.js
Please review this at http://codereview.chromium.org/10802051/
SVN Base: https://v8.googlecode.com/svn/branches/bleeding_edge
Affected files:
M src/compiler.cc
M src/objects.cc
A + test/mjsunit/regress-2249.js
Index: src/compiler.cc
diff --git a/src/compiler.cc b/src/compiler.cc
index
58ff42c7217fb09f030a0ae759f165103c7c3f76..998f1bcb20c2c554b23c4e0cd664f57f2949d915
100644
--- a/src/compiler.cc
+++ b/src/compiler.cc
@@ -819,8 +819,8 @@ bool Compiler::CompileLazy(CompilationInfo* info) {
void Compiler::RecompileParallel(Handle<JSFunction> closure) {
- ASSERT(closure->IsMarkedForParallelRecompilation());
if (closure->IsInRecompileQueue()) return;
+ ASSERT(closure->IsMarkedForParallelRecompilation());
Isolate* isolate = closure->GetIsolate();
if (!isolate->optimizing_compiler_thread()->IsQueueAvailable()) {
Index: src/objects.cc
diff --git a/src/objects.cc b/src/objects.cc
index
7ce612d83b1c79dfd49adabbe7b694ba3fbcd122..b88c73d1f38981efcfab5ebc44ea9c3dd40266a5
100644
--- a/src/objects.cc
+++ b/src/objects.cc
@@ -12447,6 +12447,31 @@ MaybeObject*
StringDictionary::TransformPropertiesToFastFor(
}
}
+ // Allocate new map.
+ Map* new_map;
+ MaybeObject* maybe_new_map = obj->map()->CopyDropDescriptors();
+ if (!maybe_new_map->To(&new_map)) return maybe_new_map;
+
+ // Calculate fields to allocate.
+ int inobject_props = obj->map()->inobject_properties();
+ int number_of_allocated_fields =
+ number_of_fields + unused_property_fields - inobject_props;
+ if (number_of_allocated_fields < 0) {
+ // There is enough inobject space for all fields (including unused).
+ number_of_allocated_fields = 0;
+ unused_property_fields = inobject_props - number_of_fields;
+ }
+
+ if (instance_descriptor_length == 0) {
+ ASSERT_EQ(0, number_of_allocated_fields);
+ // Transform the object.
+ obj->set_map(new_map);
+ obj->set_properties(heap->empty_fixed_array());
+ // Check that it really works.
+ ASSERT(obj->HasFastProperties());
+ return obj;
+ }
+
// Allocate the instance descriptor.
DescriptorArray* descriptors;
MaybeObject* maybe_descriptors =
@@ -12458,15 +12483,6 @@ MaybeObject*
StringDictionary::TransformPropertiesToFastFor(
FixedArray::WhitenessWitness witness(descriptors);
- int inobject_props = obj->map()->inobject_properties();
- int number_of_allocated_fields =
- number_of_fields + unused_property_fields - inobject_props;
- if (number_of_allocated_fields < 0) {
- // There is enough inobject space for all fields (including unused).
- number_of_allocated_fields = 0;
- unused_property_fields = inobject_props - number_of_fields;
- }
-
// Allocate the fixed array for the fields.
FixedArray* fields;
MaybeObject* maybe_fields =
@@ -12523,10 +12539,6 @@ MaybeObject*
StringDictionary::TransformPropertiesToFastFor(
ASSERT(current_offset == number_of_fields);
descriptors->Sort(witness);
- // Allocate new map.
- Map* new_map;
- MaybeObject* maybe_new_map = obj->map()->CopyDropDescriptors();
- if (!maybe_new_map->To(&new_map)) return maybe_new_map;
new_map->InitializeDescriptors(descriptors);
new_map->set_unused_property_fields(unused_property_fields);
Index: test/mjsunit/regress-2249.js
diff --git a/test/mjsunit/regress/regress-2153.js
b/test/mjsunit/regress-2249.js
similarity index 93%
copy from test/mjsunit/regress/regress-2153.js
copy to test/mjsunit/regress-2249.js
index
3170042bedc6e80f9ca11436f7162c209eb8f799..5478eb9663061328d9ccdebc59cdd3186f57535d
100644
--- a/test/mjsunit/regress/regress-2153.js
+++ b/test/mjsunit/regress-2249.js
@@ -25,8 +25,10 @@
// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+// Flags: --gc-interval=10 --stress-compaction
+
var o = {};
-o.__defineGetter__('foo', function () { return null; });
-var o = {};
-o.foo = 42;
-assertEquals(42, o.foo);
+o[Math.pow(2,30)-1] = 0;
+o[Math.pow(2,31)-1] = 0;
+o[1] = 0;
+
--
v8-dev mailing list
[email protected]
http://groups.google.com/group/v8-dev
