Revision: 21753
Author: [email protected]
Date: Wed Jun 11 04:56:55 2014 UTC
Log: Version 3.26.31.2 (merged r21743)
Fix invalid attributes when generalizing because of incompatible map change.
BUG=382143
LOG=N
[email protected]
Review URL: https://codereview.chromium.org/321383002
http://code.google.com/p/v8/source/detail?r=21753
Added:
/branches/3.26/test/mjsunit/regress/regress-crbug-382143.js
Modified:
/branches/3.26/src/objects.cc
/branches/3.26/src/objects.h
/branches/3.26/src/version.cc
=======================================
--- /dev/null
+++ /branches/3.26/test/mjsunit/regress/regress-crbug-382143.js Wed Jun 11
04:56:55 2014 UTC
@@ -0,0 +1,16 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+function A() {
+ Object.defineProperty(this, "x", { set: function () {}, get: function ()
{}});
+ this.a = function () { return 1; }
+}
+
+function B() {
+ A.apply( this );
+ this.a = function () { return 2; }
+}
+
+var b = new B();
+assertTrue(Object.getOwnPropertyDescriptor(b, "a").enumerable);
=======================================
--- /branches/3.26/src/objects.cc Tue May 6 00:04:47 2014 UTC
+++ /branches/3.26/src/objects.cc Wed Jun 11 04:56:55 2014 UTC
@@ -2344,6 +2344,18 @@
}
return new_map;
}
+
+
+// static
+Handle<Map> Map::CopyGeneralizeAllRepresentations(Handle<Map> map,
+ int modify_index,
+ StoreMode store_mode,
+ const char* reason) {
+ PropertyDetails details =
+ map->instance_descriptors()->GetDetails(modify_index);
+ return CopyGeneralizeAllRepresentations(map, modify_index, store_mode,
+ details.attributes(), reason);
+}
void Map::DeprecateTransitionTree() {
@@ -2591,8 +2603,8 @@
// Check the state of the root map.
Handle<Map> root_map(old_map->FindRootMap(), isolate);
if (!old_map->EquivalentToForTransition(*root_map)) {
- return CopyGeneralizeAllRepresentations(old_map, modify_index,
store_mode,
- old_details.attributes(), "not equivalent");
+ return CopyGeneralizeAllRepresentations(
+ old_map, modify_index, store_mode, "not equivalent");
}
int root_nof = root_map->NumberOfOwnDescriptors();
if (modify_index < root_nof) {
@@ -2601,8 +2613,8 @@
(old_details.type() == FIELD &&
(!new_field_type->NowIs(old_descriptors->GetFieldType(modify_index)) ||
!new_representation.fits_into(old_details.representation())))) {
- return CopyGeneralizeAllRepresentations(old_map, modify_index,
store_mode,
- old_details.attributes(), "root modification");
+ return CopyGeneralizeAllRepresentations(
+ old_map, modify_index, store_mode, "root modification");
}
}
@@ -2624,8 +2636,7 @@
(tmp_type != old_type ||
tmp_descriptors->GetValue(i) != old_descriptors->GetValue(i)))) {
return CopyGeneralizeAllRepresentations(
- old_map, modify_index, store_mode,
- old_details.attributes(), "incompatible");
+ old_map, modify_index, store_mode, "incompatible");
}
Representation old_representation = old_details.representation();
Representation tmp_representation = tmp_details.representation();
@@ -2689,8 +2700,7 @@
(tmp_details.type() != old_details.type() ||
tmp_descriptors->GetValue(i) != old_descriptors->GetValue(i)))) {
return CopyGeneralizeAllRepresentations(
- old_map, modify_index, store_mode,
- old_details.attributes(), "incompatible");
+ old_map, modify_index, store_mode, "incompatible");
}
target_map = tmp_map;
}
@@ -2733,6 +2743,7 @@
target_details = target_details.CopyWithRepresentation(
new_representation.generalize(target_details.representation()));
}
+ ASSERT_EQ(old_details.attributes(), target_details.attributes());
if (old_details.type() == FIELD ||
target_details.type() == FIELD ||
(modify_index == i && store_mode == FORCE_FIELD) ||
=======================================
--- /branches/3.26/src/objects.h Tue May 6 00:04:47 2014 UTC
+++ /branches/3.26/src/objects.h Wed Jun 11 04:56:55 2014 UTC
@@ -6142,6 +6142,11 @@
StoreMode store_mode,
PropertyAttributes attributes,
const char* reason);
+ static Handle<Map> CopyGeneralizeAllRepresentations(
+ Handle<Map> map,
+ int modify_index,
+ StoreMode store_mode,
+ const char* reason);
static Handle<Map> Normalize(Handle<Map> map, PropertyNormalizationMode
mode);
=======================================
--- /branches/3.26/src/version.cc Tue May 13 09:56:35 2014 UTC
+++ /branches/3.26/src/version.cc Wed Jun 11 04:56:55 2014 UTC
@@ -35,7 +35,7 @@
#define MAJOR_VERSION 3
#define MINOR_VERSION 26
#define BUILD_NUMBER 31
-#define PATCH_LEVEL 1
+#define PATCH_LEVEL 2
// Use 1 for candidates and 0 otherwise.
// (Boolean macro values are not supported by all preprocessors.)
#define IS_CANDIDATE_VERSION 0
--
--
v8-dev mailing list
[email protected]
http://groups.google.com/group/v8-dev
---
You received this message because you are subscribed to the Google Groups "v8-dev" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
For more options, visit https://groups.google.com/d/optout.
