Reviewers: mvstanton,
Description:
Fix C++ type of Factory::NewFixedDoubleArray.
The change fixes the C++ type of Factory::NewFixedDoubleArray to
reflect the empty array case, where we return an empty
FixedArray (rather than FixedDoubleArray).
[email protected]
BUG=
Please review this at https://codereview.chromium.org/249593002/
SVN Base: https://v8.googlecode.com/svn/branches/bleeding_edge
Affected files (+39, -28 lines):
M src/builtins.cc
M src/factory.h
M src/factory.cc
M src/runtime.cc
A + test/mjsunit/regress/regress-empty-fixed-double-array.js
Index: src/builtins.cc
diff --git a/src/builtins.cc b/src/builtins.cc
index
f4ce991a942d6f3db3061b632fa2da6db69f65f2..a7e1da9d5069d633482439fd75c90a797d346436
100644
--- a/src/builtins.cc
+++ b/src/builtins.cc
@@ -470,7 +470,8 @@ BUILTIN(ArrayPush) {
if (new_length > elms_len) {
// New backing storage is needed.
int capacity = new_length + (new_length >> 1) + 16;
- new_elms = isolate->factory()->NewFixedDoubleArray(capacity);
+ new_elms = Handle<FixedDoubleArray>::cast(
+ isolate->factory()->NewFixedDoubleArray(capacity));
ElementsAccessor* accessor = array->GetElementsAccessor();
accessor->CopyElements(
Index: src/factory.cc
diff --git a/src/factory.cc b/src/factory.cc
index
3aacc59d503673d627955e79d590acb3a1f066bb..60a17f1355937fb939a4f1cf08acca8762a5854e
100644
--- a/src/factory.cc
+++ b/src/factory.cc
@@ -88,23 +88,27 @@ Handle<FixedArray>
Factory::NewUninitializedFixedArray(int size) {
}
-Handle<FixedDoubleArray> Factory::NewFixedDoubleArray(int size,
+Handle<FixedArrayBase> Factory::NewFixedDoubleArray(int size,
PretenureFlag
pretenure) {
ASSERT(0 <= size);
CALL_HEAP_FUNCTION(
isolate(),
isolate()->heap()->AllocateUninitializedFixedDoubleArray(size,
pretenure),
- FixedDoubleArray);
+ FixedArrayBase);
}
-Handle<FixedDoubleArray> Factory::NewFixedDoubleArrayWithHoles(
+Handle<FixedArrayBase> Factory::NewFixedDoubleArrayWithHoles(
int size,
PretenureFlag pretenure) {
ASSERT(0 <= size);
- Handle<FixedDoubleArray> array = NewFixedDoubleArray(size, pretenure);
- for (int i = 0; i < size; ++i) {
- array->set_the_hole(i);
+ Handle<FixedArrayBase> array = NewFixedDoubleArray(size, pretenure);
+ if (size > 0) {
+ Handle<FixedDoubleArray> double_array =
+ Handle<FixedDoubleArray>::cast(array);
+ for (int i = 0; i < size; ++i) {
+ double_array->set_the_hole(i);
+ }
}
return array;
}
Index: src/factory.h
diff --git a/src/factory.h b/src/factory.h
index
f29aac4aa8fee8dd43d48712bf562040e44f0f6a..72f8a015623cb5158dfaf1fe853c02ffa13d2efb
100644
--- a/src/factory.h
+++ b/src/factory.h
@@ -33,12 +33,12 @@ class Factory V8_FINAL {
Handle<FixedArray> NewUninitializedFixedArray(int size);
// Allocate a new uninitialized fixed double array.
- Handle<FixedDoubleArray> NewFixedDoubleArray(
+ Handle<FixedArrayBase> NewFixedDoubleArray(
int size,
PretenureFlag pretenure = NOT_TENURED);
// Allocate a new fixed double array with hole values.
- Handle<FixedDoubleArray> NewFixedDoubleArrayWithHoles(
+ Handle<FixedArrayBase> NewFixedDoubleArrayWithHoles(
int size,
PretenureFlag pretenure = NOT_TENURED);
Index: src/runtime.cc
diff --git a/src/runtime.cc b/src/runtime.cc
index
ef7a74857deb6bf2a999b4b745c3028cd933f489..b45f6e3343efd03597ac83d86f49260887203a9f
100644
--- a/src/runtime.cc
+++ b/src/runtime.cc
@@ -10484,12 +10484,13 @@ RUNTIME_FUNCTION(Runtime_ArrayConcat) {
// dictionary.
bool fast_case = (estimate_nof_elements * 2) >= estimate_result_length;
- Handle<FixedArray> storage;
- if (fast_case) {
- if (kind == FAST_DOUBLE_ELEMENTS) {
+ if (fast_case && kind == FAST_DOUBLE_ELEMENTS) {
+ Handle<FixedArrayBase> storage =
+ isolate->factory()->NewFixedDoubleArray(estimate_result_length);
+ int j = 0;
+ if (estimate_result_length > 0) {
Handle<FixedDoubleArray> double_storage =
- isolate->factory()->NewFixedDoubleArray(estimate_result_length);
- int j = 0;
+ Handle<FixedDoubleArray>::cast(storage);
bool failure = false;
for (int i = 0; i < argument_count; i++) {
Handle<Object> obj(elements->get(i), isolate);
@@ -10545,15 +10546,19 @@ RUNTIME_FUNCTION(Runtime_ArrayConcat) {
}
if (failure) break;
}
- Handle<JSArray> array = isolate->factory()->NewJSArray(0);
- Smi* length = Smi::FromInt(j);
- Handle<Map> map;
- map = JSObject::GetElementsTransitionMap(array, kind);
- array->set_map(*map);
- array->set_length(length);
- array->set_elements(*double_storage);
- return *array;
}
+ Handle<JSArray> array = isolate->factory()->NewJSArray(0);
+ Smi* length = Smi::FromInt(j);
+ Handle<Map> map;
+ map = JSObject::GetElementsTransitionMap(array, kind);
+ array->set_map(*map);
+ array->set_length(length);
+ array->set_elements(*storage);
+ return *array;
+ }
+
+ Handle<FixedArray> storage;
+ if (fast_case) {
// The backing storage array must have non-existing elements to
preserve
// holes across concat operations.
storage = isolate->factory()->NewFixedArrayWithHoles(
Index: test/mjsunit/regress/regress-empty-fixed-double-array.js
diff --git a/test/mjsunit/regress/regress-observe-map-cache.js
b/test/mjsunit/regress/regress-empty-fixed-double-array.js
similarity index 66%
copy from test/mjsunit/regress/regress-observe-map-cache.js
copy to test/mjsunit/regress/regress-empty-fixed-double-array.js
index
4c7a7e3e973d12cde43caaa64b11f6f08cef3dcc..1db9e2b3e54e2abfddddd23f4ee6618ae438db20
100644
--- a/test/mjsunit/regress/regress-observe-map-cache.js
+++ b/test/mjsunit/regress/regress-empty-fixed-double-array.js
@@ -4,11 +4,12 @@
// Flags: --allow-natives-syntax --enable-slow-asserts
-function f() {
- var x = new Array(0);
- x[-1] = -1;
- Object.observe(x, function() { });
+function f(a, x) {
+ a.shift();
+ a[0] = x;
}
-f();
-f();
+f([1], 1.1);
+f([1], 1.1);
+%OptimizeFunctionOnNextCall(f);
+f([1], 1.1);
--
--
v8-dev mailing list
[email protected]
http://groups.google.com/group/v8-dev
---
You received this message because you are subscribed to the Google Groups "v8-dev" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
For more options, visit https://groups.google.com/d/optout.
