Reviewers: mvstanton,
Description:
Initialize elements pointer in BuildCloneShallowArray when allocation
folding is
turned off.
BUG=
Please review this at https://codereview.chromium.org/219173003/
SVN Base: https://v8.googlecode.com/svn/branches/bleeding_edge
Affected files (+9, -0 lines):
M src/hydrogen.cc
Index: src/hydrogen.cc
diff --git a/src/hydrogen.cc b/src/hydrogen.cc
index
80eff3b552f86cfdaeb9eec6ee3e44320a135b81..a1feeb9041bd727bda760c7be7d79b887d9269c9
100644
--- a/src/hydrogen.cc
+++ b/src/hydrogen.cc
@@ -2619,6 +2619,15 @@ HValue*
HGraphBuilder::BuildCloneShallowArray(HValue* boilerplate,
object, Add<HConstant>(JSArray::kSize), allocation_site);
}
+ // We have to initialize the elements pointer if allocation folding is
+ // turned off.
+ if (!FLAG_use_gvn || !FLAG_use_allocation_folding) {
+ HConstant* empty_fixed_array = Add<HConstant>(
+ isolate()->factory()->empty_fixed_array());
+ Add<HStoreNamedField>(object, HObjectAccess::ForElementsPointer(),
+ empty_fixed_array, INITIALIZING_STORE);
+ }
+
if (length > 0) {
HValue* boilerplate_elements = AddLoadElements(boilerplate);
HValue* object_elements;
--
--
v8-dev mailing list
[email protected]
http://groups.google.com/group/v8-dev
---
You received this message because you are subscribed to the Google Groups "v8-dev" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
For more options, visit https://groups.google.com/d/optout.
