Reviewers: Jakob,
Message:
PTAL
Description:
Allow uncacheable identifiers to go generic.
BUG=v8:2867
Please review this at https://chromiumcodereview.appspot.com/23453019/
SVN Base: https://v8.googlecode.com/svn/branches/bleeding_edge
Affected files:
M src/ic.cc
M src/objects-inl.h
M src/objects.h
M src/objects.cc
A + test/mjsunit/regress/regress-store-uncacheable.js
Index: src/ic.cc
diff --git a/src/ic.cc b/src/ic.cc
index
2a1f83d9e47ac16c98f71c4504ff46457412e6e5..afce4f78a8f7fdd8462fe37884daad75dae65e80
100644
--- a/src/ic.cc
+++ b/src/ic.cc
@@ -1719,7 +1719,8 @@ MaybeObject* StoreIC::Store(State state,
// Strict mode doesn't allow setting non-existent global property.
return ReferenceError("not_defined", name);
} else if (FLAG_use_ic &&
- (lookup.IsNormal() ||
+ (!name->IsCacheable(isolate()) ||
+ lookup.IsNormal() ||
(lookup.IsField() && lookup.CanHoldValue(value)))) {
Handle<Code> stub = strict_mode == kStrictMode
? generic_stub_strict() : generic_stub();
Index: src/objects-inl.h
diff --git a/src/objects-inl.h b/src/objects-inl.h
index
f629d9f19f52b122f9f71c838c787ab91314df5f..fb8f7ce974777f8f884cad4159f2a1d9c4dfc480
100644
--- a/src/objects-inl.h
+++ b/src/objects-inl.h
@@ -2649,6 +2649,32 @@ bool Name::Equals(Name* other) {
}
+static bool IsIdentifier(UnicodeCache* cache, Name* name) {
+ // Checks whether the buffer contains an identifier (no escape).
+ if (!name->IsString()) return false;
+ String* string = String::cast(name);
+ if (string->length() == 0) return false;
+ ConsStringIteratorOp op;
+ StringCharacterStream stream(string, &op);
+ if (!cache->IsIdentifierStart(stream.GetNext())) {
+ return false;
+ }
+ while (stream.HasMore()) {
+ if (!cache->IsIdentifierPart(stream.GetNext())) {
+ return false;
+ }
+ }
+ return true;
+}
+
+
+bool Name::IsCacheable(Isolate* isolate) {
+ return IsSymbol() ||
+ IsIdentifier(isolate->unicode_cache(), this) ||
+ this == isolate->heap()->hidden_string();
+}
+
+
ACCESSORS(Symbol, name, Object, kNameOffset)
Index: src/objects.cc
diff --git a/src/objects.cc b/src/objects.cc
index
2183fb434a9d24400ec9814a941daa0d120de2db..c98f2e5553352afb5c81f72dd92f223d8be95d9b
100644
--- a/src/objects.cc
+++ b/src/objects.cc
@@ -1909,25 +1909,6 @@ MaybeObject* JSObject::AddFastPropertyUsingMap(Map*
new_map,
}
-static bool IsIdentifier(UnicodeCache* cache, Name* name) {
- // Checks whether the buffer contains an identifier (no escape).
- if (!name->IsString()) return false;
- String* string = String::cast(name);
- if (string->length() == 0) return false;
- ConsStringIteratorOp op;
- StringCharacterStream stream(string, &op);
- if (!cache->IsIdentifierStart(stream.GetNext())) {
- return false;
- }
- while (stream.HasMore()) {
- if (!cache->IsIdentifierPart(stream.GetNext())) {
- return false;
- }
- }
- return true;
-}
-
-
MaybeObject* JSObject::AddFastProperty(Name* name,
Object* value,
PropertyAttributes attributes,
@@ -1943,10 +1924,7 @@ MaybeObject* JSObject::AddFastProperty(Name* name,
// hidden strings) and is not a real identifier.
// Normalize the object if it will have too many fast properties.
Isolate* isolate = GetHeap()->isolate();
- if ((!name->IsSymbol() &&
- !IsIdentifier(isolate->unicode_cache(), name) &&
- name != isolate->heap()->hidden_string()) ||
- TooManyFastProperties(store_mode)) {
+ if (!name->IsCacheable(isolate) || TooManyFastProperties(store_mode)) {
MaybeObject* maybe_failure =
NormalizeProperties(CLEAR_INOBJECT_PROPERTIES, 0);
if (maybe_failure->IsFailure()) return maybe_failure;
Index: src/objects.h
diff --git a/src/objects.h b/src/objects.h
index
bf0d240266fecda50c338350c15c5d72a820b959..b55049bec37a0917cd63433c6798eac92b7b8675
100644
--- a/src/objects.h
+++ b/src/objects.h
@@ -7995,6 +7995,8 @@ class Name: public HeapObject {
// Casting.
static inline Name* cast(Object* obj);
+ inline bool IsCacheable(Isolate* isolate);
+
DECLARE_PRINTER(Name)
// Layout description.
Index: test/mjsunit/regress/regress-store-uncacheable.js
diff --git a/test/mjsunit/regress/regress-crbug-173974.js
b/test/mjsunit/regress/regress-store-uncacheable.js
similarity index 96%
copy from test/mjsunit/regress/regress-crbug-173974.js
copy to test/mjsunit/regress/regress-store-uncacheable.js
index
905bd6058a0ad0fe2ebe10e4c7dafbe9945cbe3b..e9c9fc25b49c95293a5c0acea0bea8d073a79e0e
100644
--- a/test/mjsunit/regress/regress-crbug-173974.js
+++ b/test/mjsunit/regress/regress-store-uncacheable.js
@@ -28,9 +28,13 @@
// Flags: --allow-natives-syntax
function f() {
- var count = "";
- count[0] --;
+ var o = {};
+ o["<abc>"] = 123;
}
+
+f();
+f();
f();
%OptimizeFunctionOnNextCall(f);
f();
+assertOptimized(f);
--
--
v8-dev mailing list
[email protected]
http://groups.google.com/group/v8-dev
---
You received this message because you are subscribed to the Google Groups "v8-dev" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
For more options, visit https://groups.google.com/groups/opt_out.
