Reviewers: Jakob,
Message:
PTAL
Description:
Don't allow copying holes to fields.
Please review this at https://chromiumcodereview.appspot.com/15745006/
SVN Base: https://v8.googlecode.com/svn/branches/bleeding_edge
Affected files:
M src/hydrogen-instructions.h
A + test/mjsunit/regress/regress-copy-hole-to-field.js
Index: src/hydrogen-instructions.h
diff --git a/src/hydrogen-instructions.h b/src/hydrogen-instructions.h
index
d06e3184f817f2849d6e53395e3bff72aa061621..c6a5111b0514cc8e71737865dd59f1e09c85da0d
100644
--- a/src/hydrogen-instructions.h
+++ b/src/hydrogen-instructions.h
@@ -5593,6 +5593,7 @@ class HStoreNamedField: public
HTemplateInstruction<2> {
SetGVNFlag(kChangesBackingStoreFields);
SetGVNFlag(kDependsOnNewSpacePromotion);
}
+ SetFlag(kDeoptimizeOnUndefined);
}
DECLARE_CONCRETE_INSTRUCTION(StoreNamedField)
Index: test/mjsunit/regress/regress-copy-hole-to-field.js
diff --git a/test/mjsunit/regress/regress-2489.js
b/test/mjsunit/regress/regress-copy-hole-to-field.js
similarity index 82%
copy from test/mjsunit/regress/regress-2489.js
copy to test/mjsunit/regress/regress-copy-hole-to-field.js
index
882c4f794a88e24d1d64e86a466b27c39f51e625..2cd9c860053203e62db7a7fb4465726442b6ee91
100644
--- a/test/mjsunit/regress/regress-2489.js
+++ b/test/mjsunit/regress/regress-copy-hole-to-field.js
@@ -27,24 +27,30 @@
// Flags: --allow-natives-syntax
-"use strict";
+// Copy a hole from HOLEY_DOUBLE to double field.
+var a = [1.5,,1.7];
+var o = {a:1.8};
-function f(a, b) {
- return g("c", "d");
+function f(o,a,i) {
+ o.a = a[i];
}
-function g(a, b) {
- g.constructor.apply(this, arguments);
-}
+f(o,a,0);
+f(o,a,0);
+%OptimizeFunctionOnNextCall(f);
+f(o,a,1);
+print(o.a);
+
+// Copy a hole from HOLEY_SMI to smi field.
+var a = [1,,3];
+var o = {ab:5};
-g.constructor = function(a, b) {
- assertEquals("c", a);
- assertEquals("d", b);
+function f(o,a,i) {
+ o.ab = a[i];
}
-f("a", "b");
-f("a", "b");
+f(o,a,0);
+f(o,a,0);
%OptimizeFunctionOnNextCall(f);
-f("a", "b");
-g.x = "deopt";
-f("a", "b");
+f(o,a,1);
+print(o.ab);
--
--
v8-dev mailing list
[email protected]
http://groups.google.com/group/v8-dev
---
You received this message because you are subscribed to the Google Groups "v8-dev" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
For more options, visit https://groups.google.com/groups/opt_out.
