AuroraMiddleware/v8
1
0
Fork 0
Code Issues 2 Pull Requests Releases Wiki Activity

[turbofan] Don't optimize Function#bind in case of custom prototype.

Browse Source 
Avoid calling Map::TransitionToPrototype (which reads and writes the
JS heap) by skipping the JSCallReducer optimization of Function#bind
whenever the receiver has a custom prototype.

Bug: v8:7790
Change-Id: Ie21475c5dc5c53d90c6afae8198837deb40dac8e
Reviewed-on: https://chromium-review.googlesource.com/c/1288631
Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Reviewed-by: Maya Lekova <mslekova@chromium.org>
Commit-Queue: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#56840}
This commit is contained in:
Georg Neis 2018-10-18 13:18:41 +02:00 committed by Commit Bot
parent 2a08adbb6b
commit 12e0d1f2f9
1 changed files with 3 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
src/compiler/js-call-reducer.cc
View File

@ -451,16 +451,14 @@ Reduction JSCallReducer::ReduceFunctionPrototypeBind(Node* node) {
}
}
// Setup the map for the resulting JSBoundFunction with the
// correct instance {prototype}.
// Choose the map for the resulting JSBoundFunction (but bail out in case of a
// custom prototype).
Handle<Map> map(
is_constructor
? native_context()->bound_function_with_constructor_map()
: native_context()->bound_function_without_constructor_map(),
isolate());
if (map->prototype() != *prototype) {
map = Map::TransitionToPrototype(isolate(), map, prototype);
}
if (map->prototype() != *prototype) return NoChange();
// Make sure we can rely on the {receiver_maps}.
if (result == NodeProperties::kUnreliableReceiverMaps) {