Revision: 21109
Author: [email protected]
Date: Fri May 2 06:02:00 2014 UTC
Log: Object.defineProperty shouldn't be a hint that we're constructing
a dictionary.
BUG=362870
LOG=y
[email protected]
Review URL: https://codereview.chromium.org/261583004
http://code.google.com/p/v8/source/detail?r=21109
Added:
/branches/bleeding_edge/test/mjsunit/regress/regress-362870.js
Modified:
/branches/bleeding_edge/src/objects.cc
/branches/bleeding_edge/src/objects.h
/branches/bleeding_edge/src/runtime.cc
/branches/bleeding_edge/src/runtime.h
=======================================
--- /dev/null
+++ /branches/bleeding_edge/test/mjsunit/regress/regress-362870.js Fri May
2 06:02:00 2014 UTC
@@ -0,0 +1,18 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+// Adding a property via Object.defineProperty should not be taken as hint
that
+// we construct a dictionary, quite the opposite.
+var obj = {};
+
+for (var i = 0; i < 100; i++) {
+ Object.defineProperty(obj, "x" + i, { value: 31415 });
+ Object.defineProperty(obj, "y" + i, {
+ get: function() { return 42; },
+ set: function(value) { }
+ });
+ assertTrue(%HasFastProperties(obj));
+}
=======================================
--- /branches/bleeding_edge/src/objects.cc Wed Apr 30 17:27:40 2014 UTC
+++ /branches/bleeding_edge/src/objects.cc Fri May 2 06:02:00 2014 UTC
@@ -4306,7 +4306,8 @@
PropertyAttributes attributes,
ValueType value_type,
StoreMode mode,
- ExtensibilityCheck extensibility_check) {
+ ExtensibilityCheck extensibility_check,
+ StoreFromKeyed store_from_keyed) {
Isolate* isolate = object->GetIsolate();
// Make sure that the top context does not change when doing callbacks or
@@ -4347,7 +4348,7 @@
? OMIT_TRANSITION : INSERT_TRANSITION;
// Neither properties nor transitions found.
return AddProperty(object, name, value, attributes, SLOPPY,
- MAY_BE_STORE_FROM_KEYED, extensibility_check, value_type, mode,
flag);
+ store_from_keyed, extensibility_check, value_type, mode, flag);
}
Handle<Object> old_value = isolate->factory()->the_hole_value();
=======================================
--- /branches/bleeding_edge/src/objects.h Wed Apr 30 17:27:40 2014 UTC
+++ /branches/bleeding_edge/src/objects.h Fri May 2 06:02:00 2014 UTC
@@ -2159,7 +2159,8 @@
PropertyAttributes attributes,
ValueType value_type = OPTIMAL_REPRESENTATION,
StoreMode mode = ALLOW_AS_CONSTANT,
- ExtensibilityCheck extensibility_check =
PERFORM_EXTENSIBILITY_CHECK);
+ ExtensibilityCheck extensibility_check = PERFORM_EXTENSIBILITY_CHECK,
+ StoreFromKeyed store_mode = MAY_BE_STORE_FROM_KEYED);
static inline Handle<String> ExpectedTransitionKey(Handle<Map> map);
static inline Handle<Map> ExpectedTransitionTarget(Handle<Map> map);
=======================================
--- /branches/bleeding_edge/src/runtime.cc Wed Apr 30 15:17:51 2014 UTC
+++ /branches/bleeding_edge/src/runtime.cc Fri May 2 06:02:00 2014 UTC
@@ -5290,7 +5290,9 @@
Handle<Object> result;
ASSIGN_RETURN_FAILURE_ON_EXCEPTION(
isolate, result,
- Runtime::ForceSetObjectProperty(js_object, name, obj_value, attr));
+ Runtime::ForceSetObjectProperty(
+ js_object, name, obj_value, attr,
+ JSReceiver::CERTAINLY_NOT_STORE_FROM_KEYED));
return *result;
}
@@ -5402,10 +5404,12 @@
}
-MaybeHandle<Object> Runtime::ForceSetObjectProperty(Handle<JSObject>
js_object,
- Handle<Object> key,
- Handle<Object> value,
- PropertyAttributes
attr) {
+MaybeHandle<Object> Runtime::ForceSetObjectProperty(
+ Handle<JSObject> js_object,
+ Handle<Object> key,
+ Handle<Object> value,
+ PropertyAttributes attr,
+ JSReceiver::StoreFromKeyed store_from_keyed) {
Isolate* isolate = js_object->GetIsolate();
// Check if the given key is an array index.
uint32_t index;
@@ -5433,7 +5437,9 @@
} else {
if (name->IsString()) name =
String::Flatten(Handle<String>::cast(name));
return JSObject::SetLocalPropertyIgnoreAttributes(
- js_object, name, value, attr);
+ js_object, name, value, attr, Object::OPTIMAL_REPRESENTATION,
+ ALLOW_AS_CONSTANT, JSReceiver::PERFORM_EXTENSIBILITY_CHECK,
+ store_from_keyed);
}
}
@@ -5447,8 +5453,10 @@
return JSObject::SetElement(js_object, index, value, attr,
SLOPPY, false, DEFINE_PROPERTY);
} else {
- return JSObject::SetLocalPropertyIgnoreAttributes(js_object, name,
value,
- attr);
+ return JSObject::SetLocalPropertyIgnoreAttributes(
+ js_object, name, value, attr, Object::OPTIMAL_REPRESENTATION,
+ ALLOW_AS_CONSTANT, JSReceiver::PERFORM_EXTENSIBILITY_CHECK,
+ store_from_keyed);
}
}
=======================================
--- /branches/bleeding_edge/src/runtime.h Wed Apr 30 15:17:51 2014 UTC
+++ /branches/bleeding_edge/src/runtime.h Fri May 2 06:02:00 2014 UTC
@@ -820,7 +820,9 @@
Handle<JSObject> object,
Handle<Object> key,
Handle<Object> value,
- PropertyAttributes attr);
+ PropertyAttributes attr,
+ JSReceiver::StoreFromKeyed store_from_keyed
+ = JSReceiver::MAY_BE_STORE_FROM_KEYED);
MUST_USE_RESULT static MaybeHandle<Object> DeleteObjectProperty(
Isolate* isolate,
--
--
v8-dev mailing list
[email protected]
http://groups.google.com/group/v8-dev
---
You received this message because you are subscribed to the Google Groups "v8-dev" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
For more options, visit https://groups.google.com/d/optout.
