Reviewers: Sven Panne,

Message:
PTAL

Description:
Merge verbatim descriptors from other (the descriptor of the map being updated) rather than this (descriptors of the most updated map found in the transition
tree).

BUG=v8:2863

Please review this at https://chromiumcodereview.appspot.com/23676003/

SVN Base: https://v8.googlecode.com/svn/branches/bleeding_edge

Affected files:
  M src/objects.cc
  A + test/mjsunit/regress/regress-merge-descriptors.js


Index: src/objects.cc
diff --git a/src/objects.cc b/src/objects.cc
index 2b36397dc049dcc0411ac68f94f00f4d3e72a959..9d41c3ce7b5a357ba1b19afeb45b2f5256972544 100644
--- a/src/objects.cc
+++ b/src/objects.cc
@@ -7817,7 +7817,7 @@ MaybeObject* DescriptorArray::Merge(int verbatim,
   int current_offset = 0;
   for (descriptor = 0; descriptor < verbatim; descriptor++) {
     if (GetDetails(descriptor).type() == FIELD) current_offset++;
-    result->CopyFrom(descriptor, this, descriptor, witness);
+    result->CopyFrom(descriptor, other, descriptor, witness);
   }

   // |verbatim| -> |valid|
Index: test/mjsunit/regress/regress-merge-descriptors.js
diff --git a/src/hydrogen-sce.cc b/test/mjsunit/regress/regress-merge-descriptors.js
similarity index 57%
copy from src/hydrogen-sce.cc
copy to test/mjsunit/regress/regress-merge-descriptors.js
index a6995f647afc00437783f057110c7654a28265c3..a84a6254a0f8b6502b0c8f07b52da7ff99377168 100644
--- a/src/hydrogen-sce.cc
+++ b/test/mjsunit/regress/regress-merge-descriptors.js
@@ -25,38 +25,68 @@
 // (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
 // OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.

-#include "hydrogen-sce.h"
-#include "v8.h"
-
-namespace v8 {
-namespace internal {
-
-void HStackCheckEliminationPhase::Run() {
- // For each loop block walk the dominator tree from the backwards branch to - // the loop header. If a call instruction is encountered the backwards branch - // is dominated by a call and the stack check in the backwards branch can be
-  // removed.
-  for (int i = 0; i < graph()->blocks()->length(); i++) {
-    HBasicBlock* block = graph()->blocks()->at(i);
-    if (block->IsLoopHeader()) {
- HBasicBlock* back_edge = block->loop_information()->GetLastBackEdge();
-      HBasicBlock* dominator = back_edge;
-      while (true) {
- for (HInstructionIterator it(dominator); !it.Done(); it.Advance()) {
-          if (it.Current()->IsCall()) {
-            block->loop_information()->stack_check()->Eliminate();
-            break;
-          }
+var extend = function (d, b) {
+  function __() { this.constructor = d; }
+  __.prototype = b.prototype;
+  d.prototype = new __();
+};
+
+var Car = (function (Super) {
+  var Car = function () {
+    var self = this;
+
+    Super.call(self);
+
+    Object.defineProperties(self, {
+      "make": {
+        enumerable: true,
+        configurable: true,
+        get: function () {
+          return "Ford";
         }
+      }
+    });
+
+    self.copy = function () {
+      throw new Error("Meant to be overriden");
+    };
+
+    return self;
+  };
+
+  extend(Car, Super);

-        // Done when the loop header is processed.
-        if (dominator == block) break;
+  return Car;
+}(Object));

-        // Move up the dominator tree.
-        dominator = dominator->dominator();
+
+var SuperCar = ((function (Super) {
+  var SuperCar = function (make) {
+    var self = this;
+
+    Super.call(self);
+
+
+    Object.defineProperties(self, {
+      "make": {
+        enumerable: true,
+        configurable: true,
+        get: function () {
+          return make;
+        }
       }
-    }
-  }
-}
+    });
+
+    // Convert self.copy from CONSTANT to FIELD.
+    self.copy = function () { };
+
+    return self;
+  };
+  extend(SuperCar, Super);
+  return SuperCar;
+})(Car));

-} }  // namespace v8::internal
+assertEquals("Ford", new Car().make);
+assertEquals("Bugatti", new SuperCar("Bugatti").make);
+assertEquals("Lambo", new SuperCar("Lambo").make);
+assertEquals("Shelby", new SuperCar("Shelby").make);


--
--
v8-dev mailing list
[email protected]
http://groups.google.com/group/v8-dev
--- You received this message because you are subscribed to the Google Groups "v8-dev" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to [email protected].
For more options, visit https://groups.google.com/groups/opt_out.

Reply via email to