Revision: 20087
Author: [email protected]
Date: Wed Mar 19 15:49:29 2014 UTC
Log: Fix polymorphic keyed loads for SLOPPY_ARGUMENTS_ELEMENTS
BUG=chromium:350867
LOG=y
[email protected]
Review URL: https://codereview.chromium.org/203303010
http://code.google.com/p/v8/source/detail?r=20087
Added:
/branches/bleeding_edge/test/mjsunit/regress/regress-crbug-350867.js
Modified:
/branches/bleeding_edge/src/ic.cc
/branches/bleeding_edge/src/stub-cache.cc
=======================================
--- /dev/null
+++ /branches/bleeding_edge/test/mjsunit/regress/regress-crbug-350867.js
Wed Mar 19 15:49:29 2014 UTC
@@ -0,0 +1,15 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+function f1(a, i) {
+ return a[i];
+}
+function f2(a, b, c, index) {
+ return f1(arguments, index);
+}
+
+f2(2, 3, 4, "foo");
+f2(2, 3, 4, "foo");
+assertEquals(11, f1([11, 22, 33], 0));
+assertEquals(22, f2(22, 33, 44, 0));
=======================================
--- /branches/bleeding_edge/src/ic.cc Wed Mar 19 14:09:50 2014 UTC
+++ /branches/bleeding_edge/src/ic.cc Wed Mar 19 15:49:29 2014 UTC
@@ -1096,7 +1096,6 @@
maybe_object = LoadIC::Load(object, Handle<String>::cast(key));
if (maybe_object->IsFailure()) return maybe_object;
} else if (FLAG_use_ic && !object->IsAccessCheckNeeded()) {
- ASSERT(!object->IsAccessCheckNeeded());
if (object->IsString() && key->IsNumber()) {
if (state() == UNINITIALIZED) stub = string_stub();
} else if (object->IsJSObject()) {
@@ -1117,7 +1116,6 @@
if (*stub == *generic_stub()) {
TRACE_GENERIC_IC(isolate(), "KeyedLoadIC", "set generic");
}
- ASSERT(!stub.is_null());
set_target(*stub);
TRACE_IC("LoadIC", key);
}
=======================================
--- /branches/bleeding_edge/src/stub-cache.cc Tue Mar 18 14:15:09 2014 UTC
+++ /branches/bleeding_edge/src/stub-cache.cc Wed Mar 19 15:49:29 2014 UTC
@@ -1306,6 +1306,8 @@
cached_stub =
KeyedLoadFastElementStub(is_js_array,
elements_kind).GetCode(isolate());
+ } else if (elements_kind == SLOPPY_ARGUMENTS_ELEMENTS) {
+ cached_stub = isolate()->builtins()->KeyedLoadIC_SloppyArguments();
} else {
ASSERT(elements_kind == DICTIONARY_ELEMENTS);
cached_stub = KeyedLoadDictionaryElementStub().GetCode(isolate());
--
--
v8-dev mailing list
[email protected]
http://groups.google.com/group/v8-dev
---
You received this message because you are subscribed to the Google Groups "v8-dev" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
For more options, visit https://groups.google.com/d/optout.
