Reviewers: Sven Panne,
Description:
Make DescriptorArray::IsMoreGeneralThan() and DescriptorArray::Merge()
compatible again.
BUG=365172
LOG=y
TEST=mjsunit/regress/regress-365172-[1-3]
Please review this at https://codereview.chromium.org/255513005/
SVN Base: https://v8.googlecode.com/svn/branches/bleeding_edge
Affected files (+39, -6 lines):
M src/objects.cc
A + test/mjsunit/regress/regress-365172-1.js
A test/mjsunit/regress/regress-365172-2.js
A test/mjsunit/regress/regress-365172-3.js
Index: src/objects.cc
diff --git a/src/objects.cc b/src/objects.cc
index
95b2b062866bf71c34a0a3d416e77cdfed8d5b41..224f71a840d256fa5291de968465aa494b9ba52c
100644
--- a/src/objects.cc
+++ b/src/objects.cc
@@ -8520,6 +8520,10 @@ bool DescriptorArray::IsMoreGeneralThan(int verbatim,
if (details.type() == CONSTANT) {
if (other_details.type() != CONSTANT) return false;
if (GetValue(descriptor) != other->GetValue(descriptor)) return
false;
+ } else if (details.type() == FIELD && other_details.type() == FIELD) {
+ if
(!other->GetFieldType(descriptor)->NowIs(GetFieldType(descriptor))) {
+ return false;
+ }
}
}
Index: test/mjsunit/regress/regress-365172-1.js
diff --git a/test/mjsunit/harmony/regress/regress-crbug-346141.js
b/test/mjsunit/regress/regress-365172-1.js
similarity index 51%
copy from test/mjsunit/harmony/regress/regress-crbug-346141.js
copy to test/mjsunit/regress/regress-365172-1.js
index
798b7704ec2cc0eb928966fdfe9f979d0fe51f94..ea68285ea0343b2d49935763418e43ef7f329e51
100644
--- a/test/mjsunit/harmony/regress/regress-crbug-346141.js
+++ b/test/mjsunit/regress/regress-365172-1.js
@@ -2,10 +2,12 @@
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
-// Flags: --harmony-symbols
+// Flags: --track-field-types
-var s = Symbol()
-var o = {}
-o[s] = 2
-o[""] = 3
-Object.getOwnPropertySymbols(o)
+var b1 = {d: 1}; var b2 = {d: 2};
+var f1 = {x: 1}; var f2 = {x: 2};
+f1.b = b1;
+f2.x = {};
+b2.d = 4.2;
+f2.b = b2;
+var x = f1.x;
Index: test/mjsunit/regress/regress-365172-2.js
diff --git a/test/mjsunit/regress/regress-365172-2.js
b/test/mjsunit/regress/regress-365172-2.js
new file mode 100644
index
0000000000000000000000000000000000000000..265901c5c0bc195e1a4d3f1a3d50bfce31397c6f
--- /dev/null
+++ b/test/mjsunit/regress/regress-365172-2.js
@@ -0,0 +1,13 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --track-field-types
+
+var b1 = {d: 1}; var b2 = {d: 2};
+var f1 = {x: 1}; var f2 = {x: 2};
+f1.b = b1;
+f2.x = {};
+b2.d = 4.2;
+f2.b = b2;
+%TryMigrateInstance(f1);
Index: test/mjsunit/regress/regress-365172-3.js
diff --git a/test/mjsunit/regress/regress-365172-3.js
b/test/mjsunit/regress/regress-365172-3.js
new file mode 100644
index
0000000000000000000000000000000000000000..103d3d03b8ac5fa00038c62eabb9f4ad7bde30dc
--- /dev/null
+++ b/test/mjsunit/regress/regress-365172-3.js
@@ -0,0 +1,14 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --expose-gc --track-field-types
+
+function f1(a) { return {x:a, v:''}; }
+function f2(a) { return {x:{v:a}, v:''}; }
+function f3(a) { return {x:[], v:{v:''}}; }
+f3([0]);
+a = f1(1);
+a.__defineGetter__('v', function() { gc(); return f2(this); });
+a.v;
+f3(1);
--
--
v8-dev mailing list
[email protected]
http://groups.google.com/group/v8-dev
---
You received this message because you are subscribed to the Google Groups "v8-dev" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
For more options, visit https://groups.google.com/d/optout.
