Reviewers: Toon Verwaest,
Description:
Fix re-initialization of existing double field.
[email protected]
BUG=v8:2717
TEST=mjsunit/regress/regress-2717
Please review this at https://codereview.chromium.org/16735003/
SVN Base: https://v8.googlecode.com/svn/branches/bleeding_edge
Affected files:
M src/objects.cc
A + test/mjsunit/regress/regress-2717.js
Index: src/objects.cc
diff --git a/src/objects.cc b/src/objects.cc
index
4ee7734a2f78c91cfce410268e5954ab35fd614d..fc42fc7ecc43c263aef2dd187b5ef21dae588f73
100644
--- a/src/objects.cc
+++ b/src/objects.cc
@@ -4026,6 +4026,7 @@ MaybeObject*
JSObject::SetLocalPropertyIgnoreAttributes(
Representation representation = lookup.representation();
Representation value_representation =
value->OptimalRepresentation(value_type);
+ if (value_representation.IsNone()) break;
if (!value_representation.fits_into(representation)) {
MaybeObject* maybe_failure = self->GeneralizeFieldRepresentation(
lookup.GetDescriptorIndex(), value_representation);
Index: test/mjsunit/regress/regress-2717.js
diff --git a/test/mjsunit/regress/regress-crbug-245424.js
b/test/mjsunit/regress/regress-2717.js
similarity index 75%
copy from test/mjsunit/regress/regress-crbug-245424.js
copy to test/mjsunit/regress/regress-2717.js
index
005c8baba9492dd339b4fbdc3b48f7577b9c308a..4f8f7915b1c43e48235e7bd6bcb79f89957223cf
100644
--- a/test/mjsunit/regress/regress-crbug-245424.js
+++ b/test/mjsunit/regress/regress-2717.js
@@ -25,17 +25,27 @@
// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
-// Flags: --allow-natives-syntax
+// Test re-initializing existing field which is already being tracked as
+// having double representation.
+(function() {
+ function test1(a) {
+ return { x: 1.5, x: a };
+ };
+
+ assertEquals({}, test1({}).x);
+})();
+
+// Test initializing new field which follows an existing transition to a
+// map that tracks it as having double representation.
+(function() {
+ function test1(a) {
+ return { y: a };
+ };
-function boom() {
- var a = {
- foo: "bar",
- foo: "baz"
+ function test2(a) {
+ return { y: a };
};
- return a;
-}
-assertEquals("baz", boom().foo);
-assertEquals("baz", boom().foo);
-%OptimizeFunctionOnNextCall(boom);
-assertEquals("baz", boom().foo);
+ assertEquals(1.5, test1(1.5).y);
+ assertEquals({}, test2({}).y);
+})();
--
--
v8-dev mailing list
[email protected]
http://groups.google.com/group/v8-dev
---
You received this message because you are subscribed to the Google Groups "v8-dev" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
For more options, visit https://groups.google.com/groups/opt_out.
