AuroraMiddleware/v8
1
0
Fork 0
Code Issues 2 Pull Requests Releases Wiki Activity

Initialize elements pointer in BuildCloneShallowArray when allocation folding is turned off.

Browse Source 
BUG=
R=mvstanton@chromium.org

Review URL: https://codereview.chromium.org/219173003

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@20843 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
This commit is contained in:
hpayer@chromium.org 2014-04-17 11:58:48 +00:00
parent 49b19ecd20
commit 04a0223ab7
1 changed files with 9 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
src/hydrogen.cc
View File

@ -2620,6 +2620,15 @@ HValue* HGraphBuilder::BuildCloneShallowArray(HValue* boilerplate,
object, Add<HConstant>(JSArray::kSize), allocation_site);
}
// We have to initialize the elements pointer if allocation folding is
// turned off.
if (!FLAG_use_gvn || !FLAG_use_allocation_folding) {
HConstant* empty_fixed_array = Add<HConstant>(
isolate()->factory()->empty_fixed_array());
Add<HStoreNamedField>(object, HObjectAccess::ForElementsPointer(),
empty_fixed_array, INITIALIZING_STORE);
}
if (length > 0) {
HValue* boilerplate_elements = AddLoadElements(boilerplate);
HValue* object_elements;