Reviewers: Michael Starzinger,
Description:
Fix materialization of captured objects in adapted arguments.
[email protected]
BUG=348512
LOG=N
Please review this at https://codereview.chromium.org/183063006/
SVN Base: https://v8.googlecode.com/svn/branches/bleeding_edge
Affected files (+11, -11 lines):
M src/deoptimizer.cc
A + test/mjsunit/regress/regress-348512.js
Index: src/deoptimizer.cc
diff --git a/src/deoptimizer.cc b/src/deoptimizer.cc
index
1b78bae30573e12b385cfbb24720aaef89561faf..1f645e41cc6d7c18063b623178d4fcfc197dcfc8
100644
--- a/src/deoptimizer.cc
+++ b/src/deoptimizer.cc
@@ -1752,7 +1752,11 @@ Handle<Object>
Deoptimizer::MaterializeNextHeapObject() {
Handle<JSObject> arguments = Handle<JSObject>::cast(
Accessors::FunctionGetArguments(function));
materialized_objects_->Add(arguments);
- materialization_value_index_ += length;
+ // To keep consistent object counters, we still materialize the
+ // nested values (but we throw them away).
+ for (int i = 0; i < length; ++i) {
+ MaterializeNextValue();
+ }
} else if (desc.is_arguments()) {
// Construct an arguments object and copy the parameters to a newly
// allocated arguments object backing store.
Index: test/mjsunit/regress/regress-348512.js
diff --git a/test/mjsunit/recursive-store-opt.js
b/test/mjsunit/regress/regress-348512.js
similarity index 92%
copy from test/mjsunit/recursive-store-opt.js
copy to test/mjsunit/regress/regress-348512.js
index
fb2649248dbabc642f864f671d0ce2273ad44bd7..7d896664c249c1974ad468292c14284fd2e99413
100644
--- a/test/mjsunit/recursive-store-opt.js
+++ b/test/mjsunit/regress/regress-348512.js
@@ -27,15 +27,11 @@
// Flags: --allow-natives-syntax
-function g() {
- this.x = this;
-}
+function h(y) { assertEquals(42, y.u); }
+function g() { h.apply(0, arguments); }
+function f(x) { g({ u : x }); }
-function f() {
- return new g();
-}
-
-f();
-f();
+f(42);
+f(42);
%OptimizeFunctionOnNextCall(f);
-f();
+f(42);
--
--
v8-dev mailing list
[email protected]
http://groups.google.com/group/v8-dev
---
You received this message because you are subscribed to the Google Groups "v8-dev" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
For more options, visit https://groups.google.com/groups/opt_out.
