Revision: 20788
Author: [email protected]
Date: Wed Apr 16 09:48:32 2014 UTC
Log: Clear invalid field maps in PropertyAccessInfo.
BUG=363956
TEST=mjsunit/regress/regress-363956
LOG=y
[email protected]
Review URL: https://codereview.chromium.org/239623005
http://code.google.com/p/v8/source/detail?r=20788
Added:
/branches/bleeding_edge/test/mjsunit/regress/regress-363956.js
Modified:
/branches/bleeding_edge/src/hydrogen.cc
=======================================
--- /dev/null
+++ /branches/bleeding_edge/test/mjsunit/regress/regress-363956.js Wed Apr
16 09:48:32 2014 UTC
@@ -0,0 +1,12 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function Fuu() { this.x = this.x.x; }
+Fuu.prototype.x = {x: 1}
+new Fuu();
+new Fuu();
+%OptimizeFunctionOnNextCall(Fuu);
+new Fuu();
=======================================
--- /branches/bleeding_edge/src/hydrogen.cc Tue Apr 15 10:14:50 2014 UTC
+++ /branches/bleeding_edge/src/hydrogen.cc Wed Apr 16 09:48:32 2014 UTC
@@ -5493,7 +5493,7 @@
if (!IsLoad()) return false;
// Throw away type information for merging polymorphic loads.
- field_map_ = info->field_map_ = Handle<Map>();
+ info->field_map_ = Handle<Map>::null();
}
info->GeneralizeRepresentation(r);
return true;
@@ -5518,7 +5518,7 @@
access_ = HObjectAccess::ForField(map, &lookup_, name_);
// Load field map for heap objects.
- if (access_.representation().IsHeapObject()) LoadFieldMap(map);
+ LoadFieldMap(map);
} else if (lookup_.IsPropertyCallbacks()) {
Handle<Object> callback(lookup_.GetValueFromMap(*map), isolate());
if (!callback->IsAccessorPair()) return false;
@@ -5546,9 +5546,13 @@
void HOptimizedGraphBuilder::PropertyAccessInfo::LoadFieldMap(Handle<Map>
map) {
+ // Clear any previous field map.
+ field_map_ = Handle<Map>::null();
+
// Figure out the field type from the accessor map.
HeapType* field_type = lookup_.GetFieldTypeFromMap(*map);
if (field_type->IsClass()) {
+ ASSERT(access_.representation().IsHeapObject());
Handle<Map> field_map = field_type->AsClass();
if (field_map->is_stable()) {
field_map_ = field_map;
@@ -5604,7 +5608,7 @@
access_ = HObjectAccess::ForField(map, &lookup_, name_);
// Load field map for heap objects.
- if (access_.representation().IsHeapObject())
LoadFieldMap(transition());
+ LoadFieldMap(transition());
return true;
}
return false;
--
--
v8-dev mailing list
[email protected]
http://groups.google.com/group/v8-dev
---
You received this message because you are subscribed to the Google Groups "v8-dev" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
For more options, visit https://groups.google.com/d/optout.
