Reviewers: Yang,
Message:
PTAL
Description:
Revert "JSObject::NormalizeElements() handlified."
This reverts commit r20146 which broke V8 GC Stress, Mjsunit tests.
Please review this at https://codereview.chromium.org/207963002/
SVN Base: https://v8.googlecode.com/svn/branches/bleeding_edge
Affected files (+40, -27 lines):
M src/objects.h
M src/objects.cc
Index: src/objects.cc
diff --git a/src/objects.cc b/src/objects.cc
index
2eea5b6f2927fbdd0d6b2ecca51529aabaff4d81..88e723455be07ab6cb4787d835ea8dd9fd4305c8
100644
--- a/src/objects.cc
+++ b/src/objects.cc
@@ -4711,59 +4711,70 @@ static Handle<SeededNumberDictionary>
CopyFastElementsToDictionary(
Handle<SeededNumberDictionary> JSObject::NormalizeElements(
Handle<JSObject> object) {
- ASSERT(!object->HasExternalArrayElements());
- Isolate* isolate = object->GetIsolate();
- Factory* factory = isolate->factory();
+ CALL_HEAP_FUNCTION(object->GetIsolate(),
+ object->NormalizeElements(),
+ SeededNumberDictionary);
+}
+
+
+MaybeObject* JSObject::NormalizeElements() {
+ ASSERT(!HasExternalArrayElements());
// Find the backing store.
- Handle<FixedArrayBase> array(FixedArrayBase::cast(object->elements()));
+ FixedArrayBase* array = FixedArrayBase::cast(elements());
+ Map* old_map = array->map();
bool is_arguments =
- (array->map() == isolate->heap()->sloppy_arguments_elements_map());
+ (old_map == old_map->GetHeap()->sloppy_arguments_elements_map());
if (is_arguments) {
- array = handle(FixedArrayBase::cast(
- Handle<FixedArray>::cast(array)->get(1)));
+ array = FixedArrayBase::cast(FixedArray::cast(array)->get(1));
}
- if (array->IsDictionary()) return
Handle<SeededNumberDictionary>::cast(array);
+ if (array->IsDictionary()) return array;
- ASSERT(object->HasFastSmiOrObjectElements() ||
- object->HasFastDoubleElements() ||
- object->HasFastArgumentsElements());
+ ASSERT(HasFastSmiOrObjectElements() ||
+ HasFastDoubleElements() ||
+ HasFastArgumentsElements());
// Compute the effective length and allocate a new backing store.
- int length = object->IsJSArray()
- ? Smi::cast(Handle<JSArray>::cast(object)->length())->value()
+ int length = IsJSArray()
+ ? Smi::cast(JSArray::cast(this)->length())->value()
: array->length();
int old_capacity = 0;
int used_elements = 0;
- object->GetElementsCapacityAndUsage(&old_capacity, &used_elements);
- Handle<SeededNumberDictionary> dictionary =
- factory->NewSeededNumberDictionary(used_elements);
+ GetElementsCapacityAndUsage(&old_capacity, &used_elements);
+ SeededNumberDictionary* dictionary;
+ MaybeObject* maybe_dictionary =
+ SeededNumberDictionary::Allocate(GetHeap(), used_elements);
+ if (!maybe_dictionary->To(&dictionary)) return maybe_dictionary;
- dictionary = CopyFastElementsToDictionary(array, length, dictionary);
+ maybe_dictionary = CopyFastElementsToDictionary(
+ GetIsolate(), array, length, dictionary);
+ if (!maybe_dictionary->To(&dictionary)) return maybe_dictionary;
// Switch to using the dictionary as the backing storage for elements.
if (is_arguments) {
- FixedArray::cast(object->elements())->set(1, *dictionary);
+ FixedArray::cast(elements())->set(1, dictionary);
} else {
// Set the new map first to satify the elements type assert in
// set_elements().
- Handle<Map> new_map =
- JSObject::GetElementsTransitionMap(object, DICTIONARY_ELEMENTS);
-
- JSObject::MigrateToMap(object, new_map);
- object->set_elements(*dictionary);
+ Map* new_map;
+ MaybeObject* maybe = GetElementsTransitionMap(GetIsolate(),
+ DICTIONARY_ELEMENTS);
+ if (!maybe->To(&new_map)) return maybe;
+ // TODO(verwaest): Replace by MigrateToMap.
+ set_map(new_map);
+ set_elements(dictionary);
}
- isolate->counters()->elements_to_dictionary()->Increment();
+ old_map->GetHeap()->isolate()->counters()->elements_to_dictionary()->
+ Increment();
#ifdef DEBUG
if (FLAG_trace_normalization) {
PrintF("Object elements have been normalized:\n");
- object->Print();
+ Print();
}
#endif
- ASSERT(object->HasDictionaryElements() ||
- object->HasDictionaryArgumentsElements());
+ ASSERT(HasDictionaryElements() || HasDictionaryArgumentsElements());
return dictionary;
}
Index: src/objects.h
diff --git a/src/objects.h b/src/objects.h
index
f730d2f53591916e35e12f1a2ef4dc2eab1395f0..134ef04a4b791eea5639451fe528a7cbc19d797e
100644
--- a/src/objects.h
+++ b/src/objects.h
@@ -2608,6 +2608,8 @@ class JSObject: public JSReceiver {
static Handle<SeededNumberDictionary> NormalizeElements(
Handle<JSObject> object);
+ MUST_USE_RESULT MaybeObject* NormalizeElements();
+
// Transform slow named properties to fast variants.
static void TransformToFastProperties(Handle<JSObject> object,
int unused_property_fields);
--
--
v8-dev mailing list
[email protected]
http://groups.google.com/group/v8-dev
---
You received this message because you are subscribed to the Google Groups "v8-dev" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
For more options, visit https://groups.google.com/d/optout.
