Reviewers: jarin,
Message:
PTAL
Description:
Clear invalid field maps in PropertyAccessInfo.
BUG=363956
TEST=mjsunit/regress/regress-363956
LOG=y
Please review this at https://codereview.chromium.org/239623005/
SVN Base: https://v8.googlecode.com/svn/branches/bleeding_edge
Affected files (+13, -10 lines):
M src/hydrogen.cc
A + test/mjsunit/regress/regress-363956.js
Index: src/hydrogen.cc
diff --git a/src/hydrogen.cc b/src/hydrogen.cc
index
b93df482861615d499b3b4668143e2537ca9bab4..1b70767eee39444a8d7cecfd6c8b9775b09110e6
100644
--- a/src/hydrogen.cc
+++ b/src/hydrogen.cc
@@ -5493,7 +5493,7 @@ bool
HOptimizedGraphBuilder::PropertyAccessInfo::IsCompatible(
if (!IsLoad()) return false;
// Throw away type information for merging polymorphic loads.
- field_map_ = info->field_map_ = Handle<Map>();
+ info->field_map_ = Handle<Map>::null();
}
info->GeneralizeRepresentation(r);
return true;
@@ -5518,7 +5518,7 @@ bool
HOptimizedGraphBuilder::PropertyAccessInfo::LoadResult(Handle<Map> map) {
access_ = HObjectAccess::ForField(map, &lookup_, name_);
// Load field map for heap objects.
- if (access_.representation().IsHeapObject()) LoadFieldMap(map);
+ LoadFieldMap(map);
} else if (lookup_.IsPropertyCallbacks()) {
Handle<Object> callback(lookup_.GetValueFromMap(*map), isolate());
if (!callback->IsAccessorPair()) return false;
@@ -5546,9 +5546,13 @@ bool
HOptimizedGraphBuilder::PropertyAccessInfo::LoadResult(Handle<Map> map) {
void HOptimizedGraphBuilder::PropertyAccessInfo::LoadFieldMap(Handle<Map>
map) {
+ // Clear any previous field map.
+ field_map_ = Handle<Map>::null();
+
// Figure out the field type from the accessor map.
HeapType* field_type = lookup_.GetFieldTypeFromMap(*map);
if (field_type->IsClass()) {
+ ASSERT(access_.representation().IsHeapObject());
Handle<Map> field_map = field_type->AsClass();
if (field_map->is_stable()) {
field_map_ = field_map;
@@ -5604,7 +5608,7 @@ bool
HOptimizedGraphBuilder::PropertyAccessInfo::CanAccessMonomorphic() {
access_ = HObjectAccess::ForField(map, &lookup_, name_);
// Load field map for heap objects.
- if (access_.representation().IsHeapObject())
LoadFieldMap(transition());
+ LoadFieldMap(transition());
return true;
}
return false;
Index: test/mjsunit/regress/regress-363956.js
diff --git a/test/mjsunit/regress/regress-355486.js
b/test/mjsunit/regress/regress-363956.js
similarity index 60%
copy from test/mjsunit/regress/regress-355486.js
copy to test/mjsunit/regress/regress-363956.js
index
55362a13416335b72bfa1ff92bc29f7a04edbd65..76d6728c02eb1cf1549af7b463c254dbb4602a7b
100644
--- a/test/mjsunit/regress/regress-355486.js
+++ b/test/mjsunit/regress/regress-363956.js
@@ -4,10 +4,9 @@
// Flags: --allow-natives-syntax
-function f() { var v = arguments[0]; }
-function g() { f(); }
-
-g();
-g();
-%OptimizeFunctionOnNextCall(g);
-g();
+function Fuu() { this.x = this.x.x; }
+Fuu.prototype.x = {x: 1}
+new Fuu();
+new Fuu();
+%OptimizeFunctionOnNextCall(Fuu);
+new Fuu();
--
--
v8-dev mailing list
[email protected]
http://groups.google.com/group/v8-dev
---
You received this message because you are subscribed to the Google Groups "v8-dev" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
For more options, visit https://groups.google.com/d/optout.
