AuroraMiddleware/v8
1
0
Fork 0
Code Issues 2 Pull Requests Releases Wiki Activity

Add bailout for large objects when allocating arrays in optimized code.

Browse Source 
BUG=

Review URL: https://codereview.chromium.org/1408553002

Cr-Commit-Position: refs/heads/master@{#31259}
This commit is contained in:
mlippautz 2015-10-14 05:59:55 -07:00 committed by Commit bot
parent a0159c1168
commit 0c81c4e924
1 changed files with 5 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
src/hydrogen.cc
View File

@ -3514,6 +3514,11 @@ HAllocate* HGraphBuilder::JSArrayBuilder::AllocateArray(
HValue* elements_size =
builder()->BuildCalculateElementsSize(kind_, capacity);
// Bail out for large objects.
HValue* max_regular_heap_object_size =
builder()->Add<HConstant>(Page::kMaxRegularHeapObjectSize);
builder()->Add<HBoundsCheck>(elements_size, max_regular_heap_object_size);
// Allocate (dealing with failure appropriately)
HAllocate* array_object = builder()->AllocateJSArrayObject(mode_);