Reviewers: dcarney,
Message:
PTAL
Description:
Return a valid map for PropertyAccessInfos with Boolean type.
BUG=340064
LOG=N
Please review this at https://codereview.chromium.org/152603002/
SVN Base: https://v8.googlecode.com/svn/branches/bleeding_edge
Affected files (+10, -9 lines):
M src/hydrogen.h
A + test/mjsunit/regress/regress-crbug-340064.js
Index: src/hydrogen.h
diff --git a/src/hydrogen.h b/src/hydrogen.h
index
508912eff9988a8a2ac1a1e65cd6fb58372eda4d..a1676f7590d07ba4bad7ee794cdff0720e4135d9
100644
--- a/src/hydrogen.h
+++ b/src/hydrogen.h
@@ -2291,6 +2291,10 @@ class HOptimizedGraphBuilder : public HGraphBuilder,
public AstVisitor {
Context* context = current_info()->closure()->context();
context = context->native_context();
return handle(context->number_function()->initial_map());
+ } else if (type_->Is(HeapType::Boolean())) {
+ Context* context = current_info()->closure()->context();
+ context = context->native_context();
+ return handle(context->boolean_function()->initial_map());
} else if (type_->Is(HeapType::String())) {
Context* context = current_info()->closure()->context();
context = context->native_context();
Index: test/mjsunit/regress/regress-crbug-340064.js
diff --git a/test/mjsunit/regress/regress-array-pop-deopt.js
b/test/mjsunit/regress/regress-crbug-340064.js
similarity index 90%
copy from test/mjsunit/regress/regress-array-pop-deopt.js
copy to test/mjsunit/regress/regress-crbug-340064.js
index
9a0d35d3aa61b0bd3a05971b90f7c7544084d76c..f2ab1d66759cd5c2abfade19d4cf566595eec936
100644
--- a/test/mjsunit/regress/regress-array-pop-deopt.js
+++ b/test/mjsunit/regress/regress-crbug-340064.js
@@ -27,15 +27,12 @@
// Flags: --allow-natives-syntax
-var o = [6,7,8,9];
-
-function f(b) {
- var v = o.pop() + b;
- return v;
+function f(v) {
+ return v.length;
}
-assertEquals(10, f(1));
-assertEquals(9, f(1));
-assertEquals(8, f(1));
+assertEquals(4, f("test"));
+assertEquals(4, f("test"));
+assertEquals(undefined, f(true));
%OptimizeFunctionOnNextCall(f);
-assertEquals("61", f("1"));
+assertEquals(undefined, f(true));
--
--
v8-dev mailing list
[email protected]
http://groups.google.com/group/v8-dev
---
You received this message because you are subscribed to the Google Groups "v8-dev" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
For more options, visit https://groups.google.com/groups/opt_out.
