Reviewers: ulan,
Description:
Only r16598.
[email protected]
BUG=
Please review this at https://codereview.chromium.org/24253010/
SVN Base: https://v8.googlecode.com/svn/branches/3.20
Affected files (+4, -92 lines):
M src/property.h
M src/runtime.cc
M src/x64/lithium-codegen-x64.cc
D test/mjsunit/regress/regress-crbug-285355.js
D test/mjsunit/regress/regress-regexp-construct-result.js
Index: test/mjsunit/regress/regress-crbug-285355.js
diff --git a/test/mjsunit/regress/regress-crbug-285355.js
b/test/mjsunit/regress/regress-crbug-285355.js
deleted file mode 100644
index
ebd480a7103f300d726bc66ee1876d9449b05ada..0000000000000000000000000000000000000000
--- a/test/mjsunit/regress/regress-crbug-285355.js
+++ /dev/null
@@ -1,43 +0,0 @@
-// Copyright 2013 the V8 project authors. All rights reserved.
-// Redistribution and use in source and binary forms, with or without
-// modification, are permitted provided that the following conditions are
-// met:
-//
-// * Redistributions of source code must retain the above copyright
-// notice, this list of conditions and the following disclaimer.
-// * Redistributions in binary form must reproduce the above
-// copyright notice, this list of conditions and the following
-// disclaimer in the documentation and/or other materials provided
-// with the distribution.
-// * Neither the name of Google Inc. nor the names of its
-// contributors may be used to endorse or promote products derived
-// from this software without specific prior written permission.
-//
-// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
-// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
-// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
-// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
-// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
-// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
-// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
-// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
-// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
-// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
-// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
-
-// Flags: --allow-natives-syntax
-
-function inverted_index() {
- return ~1;
-}
-
-%NeverOptimizeFunction(inverted_index);
-
-function crash(array) {
- return array[~inverted_index()] = 2;
-}
-
-assertEquals(2, crash(new Array(1)));
-assertEquals(2, crash(new Array(1)));
-%OptimizeFunctionOnNextCall(crash)
-assertEquals(2, crash(new Array(1)));
Index: test/mjsunit/regress/regress-regexp-construct-result.js
diff --git a/test/mjsunit/regress/regress-regexp-construct-result.js
b/test/mjsunit/regress/regress-regexp-construct-result.js
deleted file mode 100644
index
84bdd2004bbd91d6f9ef8bf6a42ee8586c1a5abe..0000000000000000000000000000000000000000
--- a/test/mjsunit/regress/regress-regexp-construct-result.js
+++ /dev/null
@@ -1,45 +0,0 @@
-// Copyright 2013 the V8 project authors. All rights reserved.
-// Redistribution and use in source and binary forms, with or without
-// modification, are permitted provided that the following conditions are
-// met:
-//
-// * Redistributions of source code must retain the above copyright
-// notice, this list of conditions and the following disclaimer.
-// * Redistributions in binary form must reproduce the above
-// copyright notice, this list of conditions and the following
-// disclaimer in the documentation and/or other materials provided
-// with the distribution.
-// * Neither the name of Google Inc. nor the names of its
-// contributors may be used to endorse or promote products derived
-// from this software without specific prior written permission.
-//
-// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
-// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
-// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
-// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
-// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
-// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
-// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
-// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
-// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
-// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
-// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
-
-// Create a huge regexp with many alternative capture groups, most of
-// which do not capture anything, but the corresponding capture slot
-// in the result object has to exist, even though filled with undefined.
-// Having a large result array helps stressing GC.
-
-var num_captures = 1000;
-var regexp_string = "(a)";
-for (var i = 0; i < num_captures - 1; i++) {
- regexp_string += "|(b)";
-}
-var regexp = new RegExp(regexp_string);
-
-for (var i = 0; i < 10; i++) {
- var matches = regexp.exec("a");
- var count = 0;
- matches.forEach(function() { count++; });
- assertEquals(num_captures + 1, count);
-}
Index: src/property.h
diff --git a/src/property.h b/src/property.h
index
2ee6c2a2d0f40202bc9db78b35bc32ed1c45bcaa..d109de91d10144fc8b8a19e2620c3eaffdfe9ae2
100644
--- a/src/property.h
+++ b/src/property.h
@@ -225,14 +225,14 @@ class LookupResult BASE_EMBEDDED {
void HandlerResult(JSProxy* proxy) {
lookup_type_ = HANDLER_TYPE;
holder_ = proxy;
- details_ = PropertyDetails(NONE, HANDLER, Representation::Tagged());
+ details_ = PropertyDetails(NONE, HANDLER, Representation::None());
cacheable_ = false;
}
void InterceptorResult(JSObject* holder) {
lookup_type_ = INTERCEPTOR_TYPE;
holder_ = holder;
- details_ = PropertyDetails(NONE, INTERCEPTOR,
Representation::Tagged());
+ details_ = PropertyDetails(NONE, INTERCEPTOR, Representation::None());
}
void NotFound() {
Index: src/runtime.cc
diff --git a/src/runtime.cc b/src/runtime.cc
index
5b96d1fd464083359c935410293bc96f6bdc4009..69acb4a55e30354ae70061a7cf9c7ee88d99cb73
100644
--- a/src/runtime.cc
+++ b/src/runtime.cc
@@ -2433,7 +2433,7 @@ RUNTIME_FUNCTION(MaybeObject*,
Runtime_RegExpConstructResult) {
}
Object* new_object;
{ MaybeObject* maybe_new_object =
- isolate->heap()->AllocateFixedArray(elements_count);
+ isolate->heap()->AllocateFixedArrayWithHoles(elements_count);
if (!maybe_new_object->ToObject(&new_object)) return maybe_new_object;
}
FixedArray* elements = FixedArray::cast(new_object);
Index: src/x64/lithium-codegen-x64.cc
diff --git a/src/x64/lithium-codegen-x64.cc b/src/x64/lithium-codegen-x64.cc
index
4fbcbcdfc962964f01c0df20f65d7b7a049fa29c..16478b287f6dfb99bfcf966c3f94243456c28d2c
100644
--- a/src/x64/lithium-codegen-x64.cc
+++ b/src/x64/lithium-codegen-x64.cc
@@ -1407,7 +1407,7 @@ void LCodeGen::DoBitI(LBitI* instr) {
break;
case Token::BIT_XOR:
if (right_operand == int32_t(~0)) {
- __ notl(ToRegister(left));
+ __ not_(ToRegister(left));
} else {
__ xorl(ToRegister(left), Immediate(right_operand));
}
--
--
v8-dev mailing list
[email protected]
http://groups.google.com/group/v8-dev
---
You received this message because you are subscribed to the Google Groups "v8-dev" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
For more options, visit https://groups.google.com/groups/opt_out.
