Revision: 20853
Author: [email protected]
Date: Thu Apr 17 14:20:26 2014 UTC
Log: Initialize elements pointer in BuildCloneShallowArray when
allocation folding is turned off for arrays with lenght larger than zero.
BUG=
[email protected]
Review URL: https://codereview.chromium.org/240933003
http://code.google.com/p/v8/source/detail?r=20853
Modified:
/branches/bleeding_edge/src/hydrogen.cc
=======================================
--- /branches/bleeding_edge/src/hydrogen.cc Thu Apr 17 11:58:48 2014 UTC
+++ /branches/bleeding_edge/src/hydrogen.cc Thu Apr 17 14:20:26 2014 UTC
@@ -2619,17 +2619,17 @@
BuildCreateAllocationMemento(
object, Add<HConstant>(JSArray::kSize), allocation_site);
}
-
- // We have to initialize the elements pointer if allocation folding is
- // turned off.
- if (!FLAG_use_gvn || !FLAG_use_allocation_folding) {
- HConstant* empty_fixed_array = Add<HConstant>(
- isolate()->factory()->empty_fixed_array());
- Add<HStoreNamedField>(object, HObjectAccess::ForElementsPointer(),
- empty_fixed_array, INITIALIZING_STORE);
- }
if (length > 0) {
+ // We have to initialize the elements pointer if allocation folding is
+ // turned off.
+ if (!FLAG_use_gvn || !FLAG_use_allocation_folding) {
+ HConstant* empty_fixed_array = Add<HConstant>(
+ isolate()->factory()->empty_fixed_array());
+ Add<HStoreNamedField>(object, HObjectAccess::ForElementsPointer(),
+ empty_fixed_array, INITIALIZING_STORE);
+ }
+
HValue* boilerplate_elements = AddLoadElements(boilerplate);
HValue* object_elements;
if (IsFastDoubleElementsKind(kind)) {
--
--
v8-dev mailing list
[email protected]
http://groups.google.com/group/v8-dev
---
You received this message because you are subscribed to the Google Groups "v8-dev" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
For more options, visit https://groups.google.com/d/optout.
