AuroraMiddleware/v8
1
0
Fork 0
Code Issues 2 Pull Requests Releases Wiki Activity

Fix invalid attributes when generalizing because of incompatible map change.

Browse Source 
BUG=382143
LOG=y
TEST=mjsunit/regress/regress-382143
R=verwaest@chromium.org

Review URL: https://codereview.chromium.org/324933003

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@21743 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
This commit is contained in:
bmeurer@chromium.org 2014-06-10 12:24:54 +00:00
parent 6ccf6f8bf8
commit 0fcd89161b
3 changed files with 40 additions and 8 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

27
src/objects.cc
View File

@ -2416,6 +2416,18 @@ Handle<Map> Map::CopyGeneralizeAllRepresentations(Handle<Map> map,
}
// static
Handle<Map> Map::CopyGeneralizeAllRepresentations(Handle<Map> map,
int modify_index,
StoreMode store_mode,
const char* reason) {
PropertyDetails details =
map->instance_descriptors()->GetDetails(modify_index);
return CopyGeneralizeAllRepresentations(map, modify_index, store_mode,
details.attributes(), reason);
}
void Map::DeprecateTransitionTree() {
if (is_deprecated()) return;
if (HasTransitionArray()) {
@ -2661,8 +2673,8 @@ Handle<Map> Map::GeneralizeRepresentation(Handle<Map> old_map,
// Check the state of the root map.
Handle<Map> root_map(old_map->FindRootMap(), isolate);
if (!old_map->EquivalentToForTransition(*root_map)) {
return CopyGeneralizeAllRepresentations(old_map, modify_index, store_mode,
old_details.attributes(), "not equivalent");
return CopyGeneralizeAllRepresentations(
old_map, modify_index, store_mode, "not equivalent");
}
int root_nof = root_map->NumberOfOwnDescriptors();
if (modify_index < root_nof) {
@ -2671,8 +2683,8 @@ Handle<Map> Map::GeneralizeRepresentation(Handle<Map> old_map,
(old_details.type() == FIELD &&
(!new_field_type->NowIs(old_descriptors->GetFieldType(modify_index)) ||
!new_representation.fits_into(old_details.representation())))) {
return CopyGeneralizeAllRepresentations(old_map, modify_index, store_mode,
old_details.attributes(), "root modification");
return CopyGeneralizeAllRepresentations(
old_map, modify_index, store_mode, "root modification");
}
}
@ -2694,8 +2706,7 @@ Handle<Map> Map::GeneralizeRepresentation(Handle<Map> old_map,
(tmp_type != old_type ||
tmp_descriptors->GetValue(i) != old_descriptors->GetValue(i)))) {
return CopyGeneralizeAllRepresentations(
old_map, modify_index, store_mode,
old_details.attributes(), "incompatible");
old_map, modify_index, store_mode, "incompatible");
}
Representation old_representation = old_details.representation();
Representation tmp_representation = tmp_details.representation();
@ -2759,8 +2770,7 @@ Handle<Map> Map::GeneralizeRepresentation(Handle<Map> old_map,
(tmp_details.type() != old_details.type() ||
tmp_descriptors->GetValue(i) != old_descriptors->GetValue(i)))) {
return CopyGeneralizeAllRepresentations(
old_map, modify_index, store_mode,
old_details.attributes(), "incompatible");
old_map, modify_index, store_mode, "incompatible");
}
target_map = tmp_map;
}
@ -2803,6 +2813,7 @@ Handle<Map> Map::GeneralizeRepresentation(Handle<Map> old_map,
target_details = target_details.CopyWithRepresentation(
new_representation.generalize(target_details.representation()));
}
ASSERT_EQ(old_details.attributes(), target_details.attributes());
if (old_details.type() == FIELD ||
target_details.type() == FIELD ||
(modify_index == i && store_mode == FORCE_FIELD) ||

5
src/objects.h
View File

@ -6367,6 +6367,11 @@ class Map: public HeapObject {
StoreMode store_mode,
PropertyAttributes attributes,
const char* reason);
static Handle<Map> CopyGeneralizeAllRepresentations(
Handle<Map> map,
int modify_index,
StoreMode store_mode,
const char* reason);
static Handle<Map> Normalize(Handle<Map> map, PropertyNormalizationMode mode);

16
test/mjsunit/regress/regress-crbug-382143.js Normal file
View File

@ -0,0 +1,16 @@
// Copyright 2013 the V8 project authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
function A() {
Object.defineProperty(this, "x", { set: function () {}, get: function () {}});
this.a = function () { return 1; }
}
function B() {
A.apply( this );
this.a = function () { return 2; }
}
var b = new B();
assertTrue(Object.getOwnPropertyDescriptor(b, "a").enumerable);