AuroraMiddleware/v8
1
0
Fork 0
Code Issues 2 Pull Requests Releases Wiki Activity

Initialize internal arrays with the correct map.

Browse Source 
BUG=v8:1878
TEST=regress-1878.js

Review URL: https://chromiumcodereview.appspot.com/9402009

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10712 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
This commit is contained in:
yangguo@chromium.org 2012-02-15 13:45:42 +00:00
parent b21ada9a98
commit 01e46b955f
2 changed files with 14 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
src/builtins.cc
View File

@ -206,8 +206,7 @@ static MaybeObject* ArrayCodeGenericCommon(Arguments* args,
}
} else {
// Allocate the JS Array
MaybeObject* maybe_obj =
heap->AllocateEmptyJSArray(FAST_SMI_ONLY_ELEMENTS);
MaybeObject* maybe_obj = heap->AllocateJSObject(constructor);
if (!maybe_obj->To(&array)) return maybe_obj;
}

16
test/mjsunit/regress/regress-1878.js
View File

@ -1,4 +1,4 @@
// Copyright 2009 the V8 project authors. All rights reserved.
// Copyright 2012 the V8 project authors. All rights reserved.
// Redistribution and use in source and binary forms, with or without
// modification, are permitted provided that the following conditions are
// met:
@ -30,5 +30,15 @@
// Flags: --allow-natives-syntax --expose_natives_as=natives
var a = Array();
var ai = natives.InternalArray();
assertFalse(%HaveSameMap(ai, a));
for (var i = 0; i < 1000; i++) {
var ai = natives.InternalArray(10000);
assertFalse(%HaveSameMap(ai, a));
assertTrue(%HasFastElements(ai));
}
for (var i = 0; i < 1000; i++) {
var ai = new natives.InternalArray(10000);
assertFalse(%HaveSameMap(ai, a));
assertTrue(%HasFastElements(ai));
}