AuroraMiddleware/v8
1
0
Fork 0
Code Issues 2 Pull Requests Releases Wiki Activity

Make sure that NormalizeElements and ShouldConvertToFastElements are based on the same values

Browse Source 
BUG=v8:4518
LOG=n

Review URL: https://codereview.chromium.org/1472293002

Cr-Commit-Position: refs/heads/master@{#32265}
This commit is contained in:
verwaest 2015-11-25 03:46:36 -08:00 committed by Commit bot
parent 3d004eeab2
commit 066747ea05
2 changed files with 13 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

17
src/elements.cc
View File

@ -1227,13 +1227,18 @@ class FastElementsAccessor
} }
int num_used = 0; int num_used = 0;
for (int i = 0; i < backing_store->length(); ++i) { for (int i = 0; i < backing_store->length(); ++i) {
if (!backing_store->is_the_hole(i)) ++num_used; if (!backing_store->is_the_hole(i)) {
// Bail out early if more than 1/4 is used. ++num_used;
if (4 * num_used > backing_store->length()) break; // Bail out if a number dictionary wouldn't be able to save at least
} // 75% space.
if (4 * num_used <= backing_store->length()) { if (4 * SeededNumberDictionary::ComputeCapacity(num_used) *
JSObject::NormalizeElements(obj); SeededNumberDictionary::kEntrySize >
backing_store->length()) {
return;
}
}
} }
JSObject::NormalizeElements(obj);
} }
} }

2
src/objects.cc
View File

@ -14646,6 +14646,8 @@ static bool ShouldConvertToFastElements(JSObject* object,
uint32_t dictionary_size = static_cast<uint32_t>(dictionary->Capacity()) * uint32_t dictionary_size = static_cast<uint32_t>(dictionary->Capacity()) *
SeededNumberDictionary::kEntrySize; SeededNumberDictionary::kEntrySize;
// Turn fast if the dictionary only saves 50% space.
return 2 * dictionary_size >= *new_capacity; return 2 * dictionary_size >= *new_capacity;
} }