Reviewers: Toon Verwaest,
Message:
Committed patchset #1 manually as r21850 (tree was closed).
Description:
Fix representation of Phis for mutable-heapnumber-in-object-literal
properties
BUG=v8:3392
LOG=y
[email protected]
Committed: https://code.google.com/p/v8/source/detail?r=21850
Please review this at https://codereview.chromium.org/328343004/
SVN Base: https://v8.googlecode.com/svn/branches/bleeding_edge
Affected files (+9, -2 lines):
M src/hydrogen.cc
A + test/mjsunit/regress/regress-3392.js
Index: src/hydrogen.cc
diff --git a/src/hydrogen.cc b/src/hydrogen.cc
index
658cc5c2f92edeaf2fb44dc30bc3ec3aa2edd30c..c75046ddb0fecf2b3cf66bc47f43b6a7d9deca18
100644
--- a/src/hydrogen.cc
+++ b/src/hydrogen.cc
@@ -11010,7 +11010,7 @@ void
HOptimizedGraphBuilder::BuildEmitInObjectProperties(
// 1) it's a child object of another object with a valid
allocation site
// 2) we can just use the mode of the parent object for pretenuring
HInstruction* double_box =
- Add<HAllocate>(heap_number_constant, HType::HeapNumber(),
+ Add<HAllocate>(heap_number_constant, HType::HeapObject(),
pretenure_flag, HEAP_NUMBER_TYPE);
AddStoreMapConstant(double_box,
isolate()->factory()->heap_number_map());
Index: test/mjsunit/regress/regress-3392.js
diff --git a/test/mjsunit/regress/regress-crbug-382513.js
b/test/mjsunit/regress/regress-3392.js
similarity index 69%
copy from test/mjsunit/regress/regress-crbug-382513.js
copy to test/mjsunit/regress/regress-3392.js
index
59d2dcac72b5a716ff753f7ffaa0e6517c01bfa4..375f30210ce11272799c78b51463d97fc6b65998
100644
--- a/test/mjsunit/regress/regress-crbug-382513.js
+++ b/test/mjsunit/regress/regress-3392.js
@@ -4,7 +4,14 @@
// Flags: --allow-natives-syntax
-function foo() { return [+0,false].indexOf(-(4/3)); }
+function foo() {
+ var a = {b: -1.5};
+ for (var i = 0; i < 1; i++) {
+ a.b = 1;
+ }
+ assertTrue(0 <= a.b);
+}
+
foo();
foo();
%OptimizeFunctionOnNextCall(foo);
--
--
v8-dev mailing list
[email protected]
http://groups.google.com/group/v8-dev
---
You received this message because you are subscribed to the Google Groups "v8-dev" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
For more options, visit https://groups.google.com/d/optout.
