Reviewers: Igor Sheludko,
Message:
PTAL
Description:
Don't convert dictionary sloppy arguments to fast double mode.
BUG=
Please review this at https://codereview.chromium.org/207683006/
SVN Base: https://v8.googlecode.com/svn/branches/bleeding_edge
Affected files (+10, -13 lines):
M src/objects.cc
A + test/mjsunit/regress/regress-dictionary-to-fast-arguments.js
Index: src/objects.cc
diff --git a/src/objects.cc b/src/objects.cc
index
c764b33e6793ee169d0866318e19483a888e4b08..987d88139742c85065d16d1013780504423779af
100644
--- a/src/objects.cc
+++ b/src/objects.cc
@@ -11231,6 +11231,7 @@ MaybeObject*
JSObject::SetFastDoubleElementsCapacityAndLength(
}
ElementsKind elements_kind = GetElementsKind();
+ CHECK(elements_kind != SLOPPY_ARGUMENTS_ELEMENTS);
ElementsKind new_elements_kind = elements_kind;
if (IsHoleyElementsKind(elements_kind)) {
new_elements_kind = FAST_HOLEY_DOUBLE_ELEMENTS;
@@ -11250,13 +11251,9 @@ MaybeObject*
JSObject::SetFastDoubleElementsCapacityAndLength(
accessor->CopyElements(this, elems, elements_kind);
if (maybe_obj->IsFailure()) return maybe_obj;
}
- if (elements_kind != SLOPPY_ARGUMENTS_ELEMENTS) {
- ValidateElements();
- set_map_and_elements(new_map, elems);
- } else {
- FixedArray* parameter_map = FixedArray::cast(old_elements);
- parameter_map->set(1, elems);
- }
+
+ ValidateElements();
+ set_map_and_elements(new_map, elems);
if (FLAG_trace_elements_transitions) {
PrintElementsTransition(stdout, elements_kind, old_elements,
@@ -13122,6 +13119,7 @@ bool JSObject::ShouldConvertToFastElements() {
bool JSObject::ShouldConvertToFastDoubleElements(
bool* has_smi_only_elements) {
*has_smi_only_elements = false;
+ if (HasSloppyArgumentsElements()) return false;
if (FLAG_unbox_double_arrays) {
ASSERT(HasDictionaryElements());
SeededNumberDictionary* dictionary = element_dictionary();
Index: test/mjsunit/regress/regress-dictionary-to-fast-arguments.js
diff --git a/test/mjsunit/regress/regress-store-global-proxy.js
b/test/mjsunit/regress/regress-dictionary-to-fast-arguments.js
similarity index 64%
copy from test/mjsunit/regress/regress-store-global-proxy.js
copy to test/mjsunit/regress/regress-dictionary-to-fast-arguments.js
index
c85531c5fd917daa67b54e87141a164b90f3729b..f12679a663d336fa2fd321f0b8f9a48282fef307
100644
--- a/test/mjsunit/regress/regress-store-global-proxy.js
+++ b/test/mjsunit/regress/regress-dictionary-to-fast-arguments.js
@@ -2,11 +2,10 @@
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
-delete Object.prototype.__proto__;
-
-function f() {
- this.toString = 1;
+function f(a, b) {
+ for (var i = 10000; i > 0; i--) {
+ arguments[i] = 0;
+ }
}
-f.apply({});
-f();
+f(1.5, 2.5);
--
--
v8-dev mailing list
[email protected]
http://groups.google.com/group/v8-dev
---
You received this message because you are subscribed to the Google Groups "v8-dev" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
For more options, visit https://groups.google.com/d/optout.
