Reviewers: Jakob,
Message:
PTAL
Description:
Keep representations while overwriting transitions.
BUG=chromium:241477
Please review this at https://chromiumcodereview.appspot.com/15718002/
SVN Base: https://v8.googlecode.com/svn/branches/bleeding_edge
Affected files:
M src/objects.h
M src/objects.cc
M test/mjsunit/track-fields.js
Index: src/objects.cc
diff --git a/src/objects.cc b/src/objects.cc
index
6513482b718398a8fdb6967de89df78d3d1e52f4..31bbbdbeee74d4a29bc4145c6533fe1d814f85ae
100644
--- a/src/objects.cc
+++ b/src/objects.cc
@@ -2056,8 +2056,8 @@ MaybeObject*
JSObject::ConvertTransitionToMapTransition(
Map* old_target = old_map->GetTransition(transition_index);
Object* result;
- MaybeObject* maybe_result =
- ConvertDescriptorToField(name, new_value, attributes);
+ MaybeObject* maybe_result = ConvertDescriptorToField(
+ name, new_value, attributes, OMIT_TRANSITION_KEEP_REPRESENTATIONS);
if (!maybe_result->To(&result)) return maybe_result;
if (!HasFastProperties()) return result;
@@ -2098,7 +2098,8 @@ MaybeObject*
JSObject::ConvertTransitionToMapTransition(
MaybeObject* JSObject::ConvertDescriptorToField(Name* name,
Object* new_value,
- PropertyAttributes
attributes) {
+ PropertyAttributes
attributes,
+ TransitionFlag flag) {
if (map()->unused_property_fields() == 0 &&
TooManyFastProperties(properties()->length(),
MAY_BE_STORE_FROM_KEYED)) {
Object* obj;
@@ -2114,8 +2115,7 @@ MaybeObject* JSObject::ConvertDescriptorToField(Name*
name,
// Make a new map for the object.
Map* new_map;
- MaybeObject* maybe_new_map = map()->CopyInsertDescriptor(&new_field,
-
OMIT_TRANSITION);
+ MaybeObject* maybe_new_map = map()->CopyInsertDescriptor(&new_field,
flag);
if (!maybe_new_map->To(&new_map)) return maybe_new_map;
// Make new properties array if necessary.
@@ -6389,7 +6389,7 @@ MaybeObject*
Map::CopyReplaceDescriptors(DescriptorArray* descriptors,
set_transitions(transitions);
result->SetBackPointer(this);
- } else {
+ } else if (flag != OMIT_TRANSITION_KEEP_REPRESENTATIONS) {
descriptors->InitializeRepresentations(Representation::Tagged());
}
@@ -6397,6 +6397,8 @@ MaybeObject*
Map::CopyReplaceDescriptors(DescriptorArray* descriptors,
}
+// Since this method is used to rewrite an existing transition tree, it can
+// always insert transitions without checking.
MaybeObject* Map::CopyInstallDescriptors(int new_descriptor,
DescriptorArray* descriptors) {
ASSERT(descriptors->IsSortedNoDuplicates());
@@ -6419,18 +6421,14 @@ MaybeObject* Map::CopyInstallDescriptors(int
new_descriptor,
result->set_unused_property_fields(unused_property_fields);
result->set_owns_descriptors(false);
- if (CanHaveMoreTransitions()) {
- Name* name = descriptors->GetKey(new_descriptor);
- TransitionArray* transitions;
- MaybeObject* maybe_transitions =
- AddTransition(name, result, SIMPLE_TRANSITION);
- if (!maybe_transitions->To(&transitions)) return maybe_transitions;
+ Name* name = descriptors->GetKey(new_descriptor);
+ TransitionArray* transitions;
+ MaybeObject* maybe_transitions =
+ AddTransition(name, result, SIMPLE_TRANSITION);
+ if (!maybe_transitions->To(&transitions)) return maybe_transitions;
- set_transitions(transitions);
- result->SetBackPointer(this);
- } else {
- descriptors->InitializeRepresentations(Representation::Tagged());
- }
+ set_transitions(transitions);
+ result->SetBackPointer(this);
return result;
}
Index: src/objects.h
diff --git a/src/objects.h b/src/objects.h
index
2c31f30466c301982bab631d2aa6027a2908c68c..ac74162962229ccac9ff4c84c399d4903e6e1d68
100644
--- a/src/objects.h
+++ b/src/objects.h
@@ -254,6 +254,7 @@ enum CreationFlag {
// Indicates whether transitions can be added to a source map or not.
enum TransitionFlag {
INSERT_TRANSITION,
+ OMIT_TRANSITION_KEEP_REPRESENTATIONS,
OMIT_TRANSITION
};
@@ -2200,7 +2201,8 @@ class JSObject: public JSReceiver {
MUST_USE_RESULT MaybeObject* ConvertDescriptorToField(
Name* name,
Object* new_value,
- PropertyAttributes attributes);
+ PropertyAttributes attributes,
+ TransitionFlag flag = OMIT_TRANSITION);
MUST_USE_RESULT MaybeObject* MigrateToMap(Map* new_map);
MUST_USE_RESULT MaybeObject* GeneralizeFieldRepresentation(
Index: test/mjsunit/track-fields.js
diff --git a/test/mjsunit/track-fields.js b/test/mjsunit/track-fields.js
index
74389d908ade8ff6324555dfd20ae3a0eca47b77..ced006c4fbe31d702ca43bc7c35ec7a6ea7a01a5
100644
--- a/test/mjsunit/track-fields.js
+++ b/test/mjsunit/track-fields.js
@@ -306,3 +306,22 @@ test_fic(ftest3);
test_fic(ftest4);
assertTrue(%HaveSameMap(ftest1, ftest3));
assertTrue(%HaveSameMap(ftest3, ftest4));
+
+// Test representations and transition conversions.
+function read_first_double(o) {
+ return o.first_double;
+}
+var df1 = {};
+df1.first_double=1.6;
+read_first_double(df1);
+read_first_double(df1);
+function some_function1() { return 10; }
+var df2 = {};
+df2.first_double = 1.7;
+df2.second_function = some_function1;
+function some_function2() { return 20; }
+var df3 = {};
+df3.first_double = 1.7;
+df3.second_function = some_function2;
+df1.first_double = 10;
+read_first_double(df1);
--
--
v8-dev mailing list
[email protected]
http://groups.google.com/group/v8-dev
---
You received this message because you are subscribed to the Google Groups "v8-dev" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
For more options, visit https://groups.google.com/groups/opt_out.
