Reviewers: Toon Verwaest,
Description:
Merged r14751, r14753 into trunk branch.
Fix Windows shared library build.
Don't allow copying holes to fields.
[email protected]
Please review this at https://chromiumcodereview.appspot.com/15744007/
SVN Base: https://v8.googlecode.com/svn/trunk
Affected files:
M include/v8.h
M src/hydrogen-instructions.h
M src/version.cc
A + test/mjsunit/regress/regress-copy-hole-to-field.js
Index: include/v8.h
diff --git a/include/v8.h b/include/v8.h
index
b3dff3fee107a6e3992e925b488d8ba760723e50..37bd427df205ee77771445f5448c85612b8692f5
100644
--- a/include/v8.h
+++ b/include/v8.h
@@ -2735,7 +2735,7 @@ class V8EXPORT Template : public Data {
template<typename T>
-class V8EXPORT ReturnValue {
+class ReturnValue {
public:
V8_INLINE(explicit ReturnValue(internal::Object** slot));
// Handle setters
@@ -2763,7 +2763,7 @@ class V8EXPORT ReturnValue {
* the holder of the function.
*/
template<typename T>
-class V8EXPORT FunctionCallbackInfo {
+class FunctionCallbackInfo {
public:
V8_INLINE(int Length() const);
V8_INLINE(Local<Value> operator[](int i) const);
@@ -2811,7 +2811,7 @@ class V8EXPORT Arguments : public
FunctionCallbackInfo<Value> {
* of the property access.
*/
template<typename T>
-class V8EXPORT PropertyCallbackInfo {
+class PropertyCallbackInfo {
public:
V8_INLINE(Isolate* GetIsolate() const);
V8_INLINE(Local<Value> Data() const);
Index: src/hydrogen-instructions.h
diff --git a/src/hydrogen-instructions.h b/src/hydrogen-instructions.h
index
d06e3184f817f2849d6e53395e3bff72aa061621..c6a5111b0514cc8e71737865dd59f1e09c85da0d
100644
--- a/src/hydrogen-instructions.h
+++ b/src/hydrogen-instructions.h
@@ -5593,6 +5593,7 @@ class HStoreNamedField: public
HTemplateInstruction<2> {
SetGVNFlag(kChangesBackingStoreFields);
SetGVNFlag(kDependsOnNewSpacePromotion);
}
+ SetFlag(kDeoptimizeOnUndefined);
}
DECLARE_CONCRETE_INSTRUCTION(StoreNamedField)
Index: src/version.cc
diff --git a/src/version.cc b/src/version.cc
index
cec040ae467ef2aa8b0b659637da6854dc4574c8..0aa2c79eeb8ccb67beaa865a56937e4db4584c50
100644
--- a/src/version.cc
+++ b/src/version.cc
@@ -35,7 +35,7 @@
#define MAJOR_VERSION 3
#define MINOR_VERSION 19
#define BUILD_NUMBER 3
-#define PATCH_LEVEL 0
+#define PATCH_LEVEL 1
// Use 1 for candidates and 0 otherwise.
// (Boolean macro values are not supported by all preprocessors.)
#define IS_CANDIDATE_VERSION 0
Index: test/mjsunit/regress/regress-copy-hole-to-field.js
diff --git a/test/mjsunit/elide-double-hole-check-4.js
b/test/mjsunit/regress/regress-copy-hole-to-field.js
similarity index 79%
copy from test/mjsunit/elide-double-hole-check-4.js
copy to test/mjsunit/regress/regress-copy-hole-to-field.js
index
e2a55055710d6aa222ca4c4aecfbe3926d9c5cca..fa3db92928a6ca2683aa8c8a02f972e1ee4df962
100644
--- a/test/mjsunit/elide-double-hole-check-4.js
+++ b/test/mjsunit/regress/regress-copy-hole-to-field.js
@@ -27,13 +27,31 @@
// Flags: --allow-natives-syntax
-function f1(a, i) {
- return a[i] + 0.5;
+// Copy a hole from HOLEY_DOUBLE to double field.
+var a = [1.5,,1.7];
+var o = {a:1.8};
+
+function f1(o,a,i) {
+ o.a = a[i];
}
-var arr = [0.0,,2.5];
-assertEquals(0.5, f1(arr, 0));
-assertEquals(0.5, f1(arr, 0));
+
+f1(o,a,0);
+f1(o,a,0);
+assertEquals(1.5, o.a);
%OptimizeFunctionOnNextCall(f1);
-assertEquals(0.5, f1(arr, 0));
-Array.prototype[1] = 1.5;
-assertEquals(2, f1(arr, 1));
+f1(o,a,1);
+assertEquals(undefined, o.a);
+
+// Copy a hole from HOLEY_SMI to smi field.
+var a = [1,,3];
+var o = {ab:5};
+
+function f2(o,a,i) {
+ o.ab = a[i];
+}
+
+f2(o,a,0);
+f2(o,a,0);
+%OptimizeFunctionOnNextCall(f2);
+f2(o,a,1);
+assertEquals(undefined, o.ab);
--
--
v8-dev mailing list
[email protected]
http://groups.google.com/group/v8-dev
---
You received this message because you are subscribed to the Google Groups "v8-dev" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
For more options, visit https://groups.google.com/groups/opt_out.
