AuroraMiddleware/v8
1
0
Fork 0
Code Issues 2 Pull Requests Releases Wiki Activity

[turbofan] Fix double object allocation when inlining a construct call of a derived class or an Api function.

Browse Source 
Review URL: https://codereview.chromium.org/1798373002

Cr-Commit-Position: refs/heads/master@{#34780}
This commit is contained in:
ishell 2016-03-15 03:59:20 -07:00 committed by Commit bot
parent 982efab91f
commit 2ee59e5e28
2 changed files with 6 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
src/compiler/js-inlining.cc
View File

@ -300,7 +300,10 @@ bool NeedsImplicitReceiver(Handle<SharedFunctionInfo> shared_info) {
DisallowHeapAllocation no_gc;
Isolate* const isolate = shared_info->GetIsolate();
Code* const construct_stub = shared_info->construct_stub();
return construct_stub != *isolate->builtins()->JSBuiltinsConstructStub();
return construct_stub != *isolate->builtins()->JSBuiltinsConstructStub() &&
construct_stub !=
*isolate->builtins()->JSBuiltinsConstructStubForDerived() &&
construct_stub != *isolate->builtins()->JSConstructStubApi();
}
bool IsNonConstructible(Handle<SharedFunctionInfo> shared_info) {

2
test/cctest/test-inobject-slack-tracking.cc
View File

@ -612,6 +612,8 @@ static void TestClassHierarchy(const std::vector<int>& hierarchy_desc, int n) {
Handle<JSObject> tmp = Run<JSObject>(new_script);
CHECK_EQ(initial_map->IsInobjectSlackTrackingInProgress(),
IsObjectShrinkable(*tmp));
CHECK_EQ(Map::kSlackTrackingCounterStart - i - 1,
initial_map->construction_counter());
}
CHECK(!initial_map->IsInobjectSlackTrackingInProgress());
CHECK(!IsObjectShrinkable(*obj));