Revision: 20060
Author: [email protected]
Date: Wed Mar 19 11:23:59 2014 UTC
Log: Merge r19847 and r19893 to 3.23 branch.
[email protected]
BUG=350884
LOG=N
Review URL: https://codereview.chromium.org/196413031
http://code.google.com/p/v8/source/detail?r=20060
Added:
/branches/3.23/test/mjsunit/regress/regress-350884.js
Modified:
/branches/3.23/src/ic.cc
/branches/3.23/src/version.cc
=======================================
--- /dev/null
+++ /branches/3.23/test/mjsunit/regress/regress-350884.js Wed Mar 19
11:23:59 2014 UTC
@@ -0,0 +1,15 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+var obj = new Array(1);
+obj[0] = 0;
+obj[1] = 0;
+function foo(flag_index) {
+ obj[flag_index]++;
+}
+
+// Force dictionary properties on obj.
+obj[-8] = 3;
+foo(1);
+foo(2);
=======================================
--- /branches/3.23/src/ic.cc Wed Feb 26 09:04:55 2014 UTC
+++ /branches/3.23/src/ic.cc Wed Mar 19 11:23:59 2014 UTC
@@ -1746,14 +1746,15 @@
transitioned_receiver_map =
ComputeTransitionedMap(receiver, store_mode);
}
- if
(IsTransitionOfMonomorphicTarget(MapToType(transitioned_receiver_map))) {
+ if (receiver_map.is_identical_to(previous_receiver_map) ||
+
IsTransitionOfMonomorphicTarget(MapToType(transitioned_receiver_map))) {
// Element family is the same, use the "worst" case map.
store_mode = GetNonTransitioningStoreMode(store_mode);
return isolate()->stub_cache()->ComputeKeyedStoreElement(
transitioned_receiver_map, strict_mode(), store_mode);
} else if (*previous_receiver_map == receiver->map() &&
old_store_mode == STANDARD_STORE &&
- (IsGrowStoreMode(store_mode) ||
+ (store_mode == STORE_AND_GROW_NO_TRANSITION ||
store_mode == STORE_NO_TRANSITION_IGNORE_OUT_OF_BOUNDS ||
store_mode == STORE_NO_TRANSITION_HANDLE_COW)) {
// A "normal" IC that handles stores can switch to a version that can
=======================================
--- /branches/3.23/src/version.cc Mon Mar 17 12:23:20 2014 UTC
+++ /branches/3.23/src/version.cc Wed Mar 19 11:23:59 2014 UTC
@@ -35,7 +35,7 @@
#define MAJOR_VERSION 3
#define MINOR_VERSION 23
#define BUILD_NUMBER 17
-#define PATCH_LEVEL 26
+#define PATCH_LEVEL 27
// Use 1 for candidates and 0 otherwise.
// (Boolean macro values are not supported by all preprocessors.)
#define IS_CANDIDATE_VERSION 0
--
--
v8-dev mailing list
[email protected]
http://groups.google.com/group/v8-dev
---
You received this message because you are subscribed to the Google Groups "v8-dev" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
For more options, visit https://groups.google.com/d/optout.
