Reviewers: Igor Sheludko,

Message:
PTAL

Description:
Don't generate keyed store ICs for global proxies.

BUG=352983

Please review this at https://codereview.chromium.org/197873025/

SVN Base: https://v8.googlecode.com/svn/branches/bleeding_edge

Affected files (+9, -7 lines):
  M src/ic.cc
  A + test/mjsunit/regress/regress-keyed-store-global.js


Index: src/ic.cc
diff --git a/src/ic.cc b/src/ic.cc
index a3f99e4ce80946b14e6179f25f02686152f8a788..5392fbc5735a01ccc12694e162895edf233ef4eb 100644
--- a/src/ic.cc
+++ b/src/ic.cc
@@ -1687,7 +1687,9 @@ MaybeObject* KeyedStoreIC::Store(Handle<Object> object,
                                   JSReceiver::MAY_BE_STORE_FROM_KEYED);
     if (maybe_object->IsFailure()) return maybe_object;
   } else {
-    bool use_ic = FLAG_use_ic && !object->IsAccessCheckNeeded() &&
+    bool use_ic = FLAG_use_ic &&
+        !object->IsAccessCheckNeeded() &&
+        !object->IsJSGlobalProxy() &&
         !(object->IsJSObject() &&
           JSObject::cast(*object)->map()->is_observed());
     if (use_ic && !object->IsSmi()) {
Index: test/mjsunit/regress/regress-keyed-store-global.js
diff --git a/test/mjsunit/regress/regress-store-global-proxy.js b/test/mjsunit/regress/regress-keyed-store-global.js
similarity index 57%
copy from test/mjsunit/regress/regress-store-global-proxy.js
copy to test/mjsunit/regress/regress-keyed-store-global.js
index c85531c5fd917daa67b54e87141a164b90f3729b..1b127776d6c3635bbf6e57b2256319288b8f411c 100644
--- a/test/mjsunit/regress/regress-store-global-proxy.js
+++ b/test/mjsunit/regress/regress-keyed-store-global.js
@@ -2,11 +2,11 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.

-delete Object.prototype.__proto__;
-
-function f() {
-  this.toString = 1;
+// Flags: --allow-natives-syntax --verify-heap
+function f(a) {
+  for (var i = 0; i < 256; i++) a[i] = i;
 }

-f.apply({});
-f();
+f([]);
+f([]);
+f(this);


--
--
v8-dev mailing list
[email protected]
http://groups.google.com/group/v8-dev
--- You received this message because you are subscribed to the Google Groups "v8-dev" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to [email protected].
For more options, visit https://groups.google.com/d/optout.

Reply via email to