AuroraMiddleware/v8
1
0
Fork 0
Code Issues 2 Pull Requests Releases Wiki Activity

Remove obsolete 'arguments' local variable handling.

Browse Source 
This removes special casing for the 'f.arguments' property accessor. Any
local 'arguments' variable should not be allowed to influence the value
returned by the indirect 'f.arguments' property. That property creates a
new object with a separate identity everytime it is read. This is by now
consistent with other browsers.

R=rossberg@chromium.org
TEST=mjsunit/arguments-indirect

Review URL: https://codereview.chromium.org/1408983006

Cr-Commit-Position: refs/heads/master@{#31776}
This commit is contained in:
mstarzinger 2015-11-04 02:35:46 -08:00 committed by Commit bot
parent 41775a3e73
commit 124efdd3e8
4 changed files with 14 additions and 21 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

15
src/accessors.cc
View File

@ -1175,20 +1175,7 @@ Handle<Object> GetFunctionArguments(Isolate* isolate,
return ArgumentsForInlinedFunction(frame, function, function_index);
}
if (!frame->is_optimized()) {
// If there is an arguments variable in the stack, we return that.
Handle<ScopeInfo> scope_info(function->shared()->scope_info());
int index = scope_info->StackSlotIndex(
isolate->heap()->arguments_string());
if (index >= 0) {
Handle<Object> arguments(frame->GetExpression(index), isolate);
if (!arguments->IsArgumentsMarker()) return arguments;
}
}
// If there is no arguments variable in the stack or we have an
// optimized frame, we find the frame that holds the actual arguments
// passed to the function.
// Find the frame that holds the actual arguments passed to the function.
it.AdvanceToArgumentsFrame();
frame = it.frame();

10
test/mjsunit/arguments-indirect.js
View File

@ -35,8 +35,15 @@ function f2(x) {
g(f2);
}
function f3(x) {
var a = arguments;
(function() { x++ })();
g(f3);
}
function g(f) {
assertEquals("object", typeof f.arguments);
assertFalse(f.arguments === f.arguments);
assertEquals(3, f.arguments.length);
assertEquals(1, f.arguments[0]);
assertEquals(2, f.arguments[1]);
@ -44,4 +51,5 @@ function g(f) {
}
f1(1,2,3);
f2(0,2,3);
f2(1,2,3);
f3(1,2,3);

5
test/mjsunit/mjsunit.status
View File

@ -57,11 +57,6 @@
##############################################################################
# TurboFan compiler failures.
# TODO(mstarzinger): An arguments object materialized in the prologue can't
# be accessed indirectly. Either we drop that requirement or wait for support
# from the deoptimizer to do that.
'arguments-indirect': [PASS, NO_VARIANTS],
# TODO(verwaest): Some tests are over-restrictive about object layout.
'array-constructor-feedback': [PASS, NO_VARIANTS],
'array-feedback': [PASS, NO_VARIANTS],

5
test/mozilla/mozilla.status
View File

@ -55,7 +55,6 @@
# TODO(turbofan): These are all covered by mjsunit as well. Enable them once
# we pass 'mjsunit' and 'webkit' with TurboFan.
'js1_4/Functions/function-001': [PASS, NO_VARIANTS],
'js1_5/Regress/regress-80981': [PASS, NO_VARIANTS],
# TODO(turbofan): Causes timeouts since top-level code is optimized.
@ -264,6 +263,10 @@
# This section is for tests that fail in both V8 and JSC. Thus they
# have been determined to be incompatible between Mozilla and V8/JSC.
# Any local 'arguments' variable should not be allowed to shadow the value
# returned via the indirect 'arguments' property accessor.
'js1_4/Functions/function-001': [FAIL_OK],
# toPrecision argument restricted to range 1..21 in JSC/V8 and ECMA-262
'js1_5/Regress/regress-452346': [FAIL_OK],