Reviewers: Hannes Payer, Toon Verwaest,

Message:
Here is the port to M30. So far I've got Toon's fix, but I believe we need to
accumulate a fix or two from Hannes regarding allocation folding.
Thanks,
--Michael

Description:
Port fix for bug chromium 284577 to m30.
The original CL is at https://code.google.com/p/v8/source/detail?r=16790


BUG=

Please review this at https://codereview.chromium.org/24175009/

SVN Base: https://v8.googlecode.com/svn/branches/3.20

Affected files (+6, -6 lines):
  M src/hydrogen.cc


Index: src/hydrogen.cc
diff --git a/src/hydrogen.cc b/src/hydrogen.cc
index cf5b41983fafc2240121da4c9b4968cc029a1d62..14b617c08d9865340bf8d7020f2ef0446bd9d16a 100644
--- a/src/hydrogen.cc
+++ b/src/hydrogen.cc
@@ -8241,7 +8241,10 @@ HInstruction* HOptimizedGraphBuilder::BuildFastLiteral(
     int pointer_size,
     AllocationSiteMode mode) {
   NoObservableSideEffectsScope no_effects(this);
-
+  InstanceType instance_type = boilerplate_object->map()->instance_type();
+ ASSERT(instance_type == JS_ARRAY_TYPE || instance_type == JS_OBJECT_TYPE);
+  HType type = instance_type == JS_ARRAY_TYPE
+      ? HType::JSArray() : HType::JSObject();
   HInstruction* target = NULL;
   HInstruction* data_target = NULL;

@@ -8258,14 +8261,11 @@ HInstruction* HOptimizedGraphBuilder::BuildFastLiteral(
     }
     if (pointer_size != 0) {
       HValue* size_in_bytes = Add<HConstant>(pointer_size);
-      target = Add<HAllocate>(size_in_bytes, HType::JSObject(), TENURED,
-          JS_OBJECT_TYPE);
+      target = Add<HAllocate>(size_in_bytes, type, TENURED, instance_type);
     }
   } else {
- InstanceType instance_type = boilerplate_object->map()->instance_type();
     HValue* size_in_bytes = Add<HConstant>(data_size + pointer_size);
-    target = Add<HAllocate>(size_in_bytes, HType::JSObject(), NOT_TENURED,
-        instance_type);
+ target = Add<HAllocate>(size_in_bytes, type, NOT_TENURED, instance_type);
   }

   int offset = 0;


--
--
v8-dev mailing list
[email protected]
http://groups.google.com/group/v8-dev
--- You received this message because you are subscribed to the Google Groups "v8-dev" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to [email protected].
For more options, visit https://groups.google.com/groups/opt_out.

Reply via email to