AuroraMiddleware/v8
1
0
Fork 0
Code Issues 2 Pull Requests Releases Wiki Activity

Initialize elements pointer in BuildCloneShallowArray when allocation folding is turned off for arrays with lenght larger than zero.

Browse Source 
BUG=
R=mvstanton@chromium.org

Review URL: https://codereview.chromium.org/240933003

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@20853 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
This commit is contained in:
hpayer@chromium.org 2014-04-17 14:20:26 +00:00
parent 439f68dd45
commit 540a4c3895
1 changed files with 9 additions and 9 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

18
src/hydrogen.cc
View File

@ -2620,16 +2620,16 @@ HValue* HGraphBuilder::BuildCloneShallowArray(HValue* boilerplate,
object, Add<HConstant>(JSArray::kSize), allocation_site);
}
// We have to initialize the elements pointer if allocation folding is
// turned off.
if (!FLAG_use_gvn || !FLAG_use_allocation_folding) {
HConstant* empty_fixed_array = Add<HConstant>(
isolate()->factory()->empty_fixed_array());
Add<HStoreNamedField>(object, HObjectAccess::ForElementsPointer(),
empty_fixed_array, INITIALIZING_STORE);
}
if (length > 0) {
// We have to initialize the elements pointer if allocation folding is
// turned off.
if (!FLAG_use_gvn || !FLAG_use_allocation_folding) {
HConstant* empty_fixed_array = Add<HConstant>(
isolate()->factory()->empty_fixed_array());
Add<HStoreNamedField>(object, HObjectAccess::ForElementsPointer(),
empty_fixed_array, INITIALIZING_STORE);
}
HValue* boilerplate_elements = AddLoadElements(boilerplate);
HValue* object_elements;
if (IsFastDoubleElementsKind(kind)) {