AuroraMiddleware/v8
1
0
Fork 0
Code Issues 2 Pull Requests Releases Wiki Activity

Remove premature crankshaft optimization of HasInPrototypeChain.

Browse Source 
R=bmeurer@chromium.org
BUG=chromium:578775
LOG=n

Review URL: https://codereview.chromium.org/1605483002

Cr-Commit-Position: refs/heads/master@{#33356}
This commit is contained in:
neis 2016-01-18 04:11:49 -08:00 committed by Commit bot
parent dac46ef717
commit 107db2ca8c
4 changed files with 19 additions and 14 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

12
src/crankshaft/hydrogen.cc
View File

@ -12740,18 +12740,6 @@ void HOptimizedGraphBuilder::GenerateMathSqrt(CallRuntime* call) {
} }
void HOptimizedGraphBuilder::GenerateHasInPrototypeChain(CallRuntime* call) {
DCHECK_EQ(2, call->arguments()->length());
CHECK_ALIVE(VisitForValue(call->arguments()->at(0)));
CHECK_ALIVE(VisitForValue(call->arguments()->at(1)));
HValue* prototype = Pop();
HValue* object = Pop();
HHasInPrototypeChainAndBranch* result =
New<HHasInPrototypeChainAndBranch>(object, prototype);
return ast_context()->ReturnControl(result, call->id());
}
void HOptimizedGraphBuilder::GenerateFixedArrayGet(CallRuntime* call) { void HOptimizedGraphBuilder::GenerateFixedArrayGet(CallRuntime* call) {
DCHECK(call->arguments()->length() == 2); DCHECK(call->arguments()->length() == 2);
CHECK_ALIVE(VisitForValue(call->arguments()->at(0))); CHECK_ALIVE(VisitForValue(call->arguments()->at(0)));

1
src/crankshaft/hydrogen.h
View File

@ -2231,7 +2231,6 @@ class HOptimizedGraphBuilder : public HGraphBuilder, public AstVisitor {
F(RegExpSource) \ F(RegExpSource) \
F(NumberToString) \ F(NumberToString) \
F(DebugIsActive) \ F(DebugIsActive) \
F(HasInPrototypeChain) \
/* Typed Arrays */ \ /* Typed Arrays */ \
F(TypedArrayInitialize) \ F(TypedArrayInitialize) \
F(DataViewInitialize) \ F(DataViewInitialize) \

2
src/js/v8natives.js
View File

@ -148,7 +148,7 @@ function ObjectHasOwnProperty(value) {
function ObjectIsPrototypeOf(V) { function ObjectIsPrototypeOf(V) {
if (!IS_RECEIVER(V)) return false; if (!IS_RECEIVER(V)) return false;
var O = TO_OBJECT(this); var O = TO_OBJECT(this);
return %_HasInPrototypeChain(V, O); return %HasInPrototypeChain(V, O);
} }

18
test/mjsunit/regress/regress-578775.js Normal file
View File

@ -0,0 +1,18 @@
// Copyright 2016 the V8 project authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
// https://code.google.com/p/chromium/issues/detail?id=578775
var __v_9 = {};
for (var __v_0 = 0; __v_0 < 1000; __v_0++) {
}
__v_2 = { __v_2: 1 };
__v_12 = new Proxy({}, {});
function f() {
var __v_10 = new Proxy({}, __v_2);
__v_9.__proto__ = __v_10;
__v_2.getPrototypeOf = function () { return __v_9 };
Object.prototype.isPrototypeOf.call(__v_0, __v_10);
};
assertThrows(f, RangeError);