Revision: 20843
Author: [email protected]
Date: Thu Apr 17 11:58:48 2014 UTC
Log: Initialize elements pointer in BuildCloneShallowArray when
allocation folding is turned off.
BUG=
[email protected]
Review URL: https://codereview.chromium.org/219173003
http://code.google.com/p/v8/source/detail?r=20843
Modified:
/branches/bleeding_edge/src/hydrogen.cc
=======================================
--- /branches/bleeding_edge/src/hydrogen.cc Thu Apr 17 11:37:59 2014 UTC
+++ /branches/bleeding_edge/src/hydrogen.cc Thu Apr 17 11:58:48 2014 UTC
@@ -2619,6 +2619,15 @@
BuildCreateAllocationMemento(
object, Add<HConstant>(JSArray::kSize), allocation_site);
}
+
+ // We have to initialize the elements pointer if allocation folding is
+ // turned off.
+ if (!FLAG_use_gvn || !FLAG_use_allocation_folding) {
+ HConstant* empty_fixed_array = Add<HConstant>(
+ isolate()->factory()->empty_fixed_array());
+ Add<HStoreNamedField>(object, HObjectAccess::ForElementsPointer(),
+ empty_fixed_array, INITIALIZING_STORE);
+ }
if (length > 0) {
HValue* boilerplate_elements = AddLoadElements(boilerplate);
--
--
v8-dev mailing list
[email protected]
http://groups.google.com/group/v8-dev
---
You received this message because you are subscribed to the Google Groups "v8-dev" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
For more options, visit https://groups.google.com/d/optout.
