AuroraMiddleware/v8
1
0
Fork 0
Code Issues 2 Pull Requests Releases Wiki Activity

Make DescriptorArray::IsMoreGeneralThan() and DescriptorArray::Merge() compatible again.

Browse Source 
BUG=365172
LOG=y
TEST=mjsunit/regress/regress-365172-[1-3]
R=svenpanne@chromium.org

Review URL: https://codereview.chromium.org/255513005

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@20922 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
This commit is contained in:
bmeurer@chromium.org 2014-04-24 08:07:14 +00:00
parent 9d5d1764f9
commit 052f9e9b6d
4 changed files with 44 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
src/objects.cc
View File

@ -8520,6 +8520,10 @@ bool DescriptorArray::IsMoreGeneralThan(int verbatim,
if (details.type() == CONSTANT) {
if (other_details.type() != CONSTANT) return false;
if (GetValue(descriptor) != other->GetValue(descriptor)) return false;
} else if (details.type() == FIELD && other_details.type() == FIELD) {
if (!other->GetFieldType(descriptor)->NowIs(GetFieldType(descriptor))) {
return false;
}
}
}

13
test/mjsunit/regress/regress-365172-1.js Normal file
View File

@ -0,0 +1,13 @@
// Copyright 2014 the V8 project authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
// Flags: --track-field-types
var b1 = {d: 1}; var b2 = {d: 2};
var f1 = {x: 1}; var f2 = {x: 2};
f1.b = b1;
f2.x = {};
b2.d = 4.2;
f2.b = b2;
var x = f1.x;

13
test/mjsunit/regress/regress-365172-2.js Normal file
View File

@ -0,0 +1,13 @@
// Copyright 2014 the V8 project authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
// Flags: --allow-natives-syntax --track-field-types
var b1 = {d: 1}; var b2 = {d: 2};
var f1 = {x: 1}; var f2 = {x: 2};
f1.b = b1;
f2.x = {};
b2.d = 4.2;
f2.b = b2;
%TryMigrateInstance(f1);

14
test/mjsunit/regress/regress-365172-3.js Normal file
View File

@ -0,0 +1,14 @@
// Copyright 2014 the V8 project authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
// Flags: --expose-gc --track-field-types
function f1(a) { return {x:a, v:''}; }
function f2(a) { return {x:{v:a}, v:''}; }
function f3(a) { return {x:[], v:{v:''}}; }
f3([0]);
a = f1(1);
a.__defineGetter__('v', function() { gc(); return f2(this); });
a.v;
f3(1);