Reviewers: Hannes Payer,
Description:
Implement materialization support for JSArray types.
[email protected]
TEST=mjsunit/regress/regress-crbug-150729 (+FastLiteral)
Please review this at https://codereview.chromium.org/23502004/
SVN Base: https://v8.googlecode.com/svn/branches/bleeding_edge
Affected files:
M src/deoptimizer.cc
Index: src/deoptimizer.cc
diff --git a/src/deoptimizer.cc b/src/deoptimizer.cc
index
dc9ffc51186be1c5535297c6adf77f9efbf922b1..253815a94362f6d89bf8d90471e64637e8409891
100644
--- a/src/deoptimizer.cc
+++ b/src/deoptimizer.cc
@@ -1696,13 +1696,25 @@ Handle<Object>
Deoptimizer::MaterializeNextHeapObject() {
Handle<Object> properties = MaterializeNextValue();
Handle<Object> elements = MaterializeNextValue();
object->set_properties(FixedArray::cast(*properties));
- object->set_elements(FixedArray::cast(*elements));
+ object->set_elements(FixedArrayBase::cast(*elements));
for (int i = 0; i < length - 3; ++i) {
Handle<Object> value = MaterializeNextValue();
object->FastPropertyAtPut(i, *value);
}
break;
}
+ case JS_ARRAY_TYPE: {
+ Handle<JSArray> object =
+ isolate_->factory()->NewJSArray(0, map->elements_kind());
+ materialized_objects_->Add(object);
+ Handle<Object> properties = MaterializeNextValue();
+ Handle<Object> elements = MaterializeNextValue();
+ Handle<Object> length = MaterializeNextValue();
+ object->set_properties(FixedArray::cast(*properties));
+ object->set_elements(FixedArrayBase::cast(*elements));
+ object->set_length(*length);
+ break;
+ }
default:
PrintF("[couldn't handle instance type %d]\n",
map->instance_type());
UNREACHABLE();
--
--
v8-dev mailing list
[email protected]
http://groups.google.com/group/v8-dev
---
You received this message because you are subscribed to the Google Groups "v8-dev" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
For more options, visit https://groups.google.com/groups/opt_out.
