diff --git a/src/objects-inl.h b/src/objects-inl.h index b844da731e..7c7f094006 100644 --- a/src/objects-inl.h +++ b/src/objects-inl.h @@ -1219,7 +1219,7 @@ void JSObject::ValidateSmiOnlyElements() { map != heap->free_space_map()) { for (int i = 0; i < fixed_array->length(); i++) { Object* current = fixed_array->get(i); - ASSERT(current->IsSmi() || current->IsTheHole()); + ASSERT(current->IsSmi() || current == heap->the_hole_value()); } } } diff --git a/src/objects.cc b/src/objects.cc index 2323484ee5..ae5aa78cae 100644 --- a/src/objects.cc +++ b/src/objects.cc @@ -8188,13 +8188,10 @@ MaybeObject* JSObject::SetFastElementsCapacityAndLength( Map* new_map = NULL; if (elements()->map() != heap->non_strict_arguments_elements_map()) { Object* object; - // The resized array has FAST_SMI_ONLY_ELEMENTS if the capacity mode forces - // it, or if it's allowed and the old elements array contained only SMIs. bool has_fast_smi_only_elements = - (set_capacity_mode == kForceSmiOnlyElements) || - ((set_capacity_mode == kAllowSmiOnlyElements) && - (elements()->map()->has_fast_smi_only_elements() || - elements() == heap->empty_fixed_array())); + (set_capacity_mode == kAllowSmiOnlyElements) && + (elements()->map()->has_fast_smi_only_elements() || + elements() == heap->empty_fixed_array()); ElementsKind elements_kind = has_fast_smi_only_elements ? FAST_SMI_ONLY_ELEMENTS : FAST_ELEMENTS; @@ -9244,20 +9241,11 @@ MaybeObject* JSObject::SetDictionaryElement(uint32_t index, } else { new_length = dictionary->max_number_key() + 1; } - SetFastElementsCapacityMode set_capacity_mode = FLAG_smi_only_arrays - ? kAllowSmiOnlyElements - : kDontAllowSmiOnlyElements; - bool has_smi_only_elements = false; - bool should_convert_to_fast_double_elements = - ShouldConvertToFastDoubleElements(&has_smi_only_elements); - if (has_smi_only_elements) { - set_capacity_mode = kForceSmiOnlyElements; - } - MaybeObject* result = should_convert_to_fast_double_elements + MaybeObject* result = CanConvertToFastDoubleElements() ? SetFastDoubleElementsCapacityAndLength(new_length, new_length) : SetFastElementsCapacityAndLength(new_length, new_length, - set_capacity_mode); + kDontAllowSmiOnlyElements); if (result->IsFailure()) return result; #ifdef DEBUG if (FLAG_trace_normalization) { @@ -9736,25 +9724,17 @@ bool JSObject::ShouldConvertToFastElements() { } -bool JSObject::ShouldConvertToFastDoubleElements( - bool* has_smi_only_elements) { - *has_smi_only_elements = false; +bool JSObject::CanConvertToFastDoubleElements() { if (FLAG_unbox_double_arrays) { ASSERT(HasDictionaryElements()); NumberDictionary* dictionary = NumberDictionary::cast(elements()); - bool found_double = false; for (int i = 0; i < dictionary->Capacity(); i++) { Object* key = dictionary->KeyAt(i); if (key->IsNumber()) { - Object* value = dictionary->ValueAt(i); - if (!value->IsNumber()) return false; - if (!value->IsSmi()) { - found_double = true; - } + if (!dictionary->ValueAt(i)->IsNumber()) return false; } } - *has_smi_only_elements = !found_double; - return found_double; + return true; } else { return false; } diff --git a/src/objects.h b/src/objects.h index 912cd21ab2..5346585bd3 100644 --- a/src/objects.h +++ b/src/objects.h @@ -1644,9 +1644,8 @@ class JSObject: public JSReceiver { // elements. bool ShouldConvertToFastElements(); // Returns true if the elements of JSObject contains only values that can be - // represented in a FixedDoubleArray and has at least one value that can only - // be represented as a double and not a Smi. - bool ShouldConvertToFastDoubleElements(bool* has_smi_only_elements); + // represented in a FixedDoubleArray. + bool CanConvertToFastDoubleElements(); // Tells whether the index'th element is present. bool HasElementWithReceiver(JSReceiver* receiver, uint32_t index); @@ -1709,7 +1708,6 @@ class JSObject: public JSReceiver { enum SetFastElementsCapacityMode { kAllowSmiOnlyElements, - kForceSmiOnlyElements, kDontAllowSmiOnlyElements }; diff --git a/test/mjsunit/regress/regress-1849.js b/test/mjsunit/regress/regress-1849.js deleted file mode 100644 index 176f918b93..0000000000 --- a/test/mjsunit/regress/regress-1849.js +++ /dev/null @@ -1,39 +0,0 @@ -// Copyright 2011 the V8 project authors. All rights reserved. -// Redistribution and use in source and binary forms, with or without -// modification, are permitted provided that the following conditions are -// met: -// -// * Redistributions of source code must retain the above copyright -// notice, this list of conditions and the following disclaimer. -// * Redistributions in binary form must reproduce the above -// copyright notice, this list of conditions and the following -// disclaimer in the documentation and/or other materials provided -// with the distribution. -// * Neither the name of Google Inc. nor the names of its -// contributors may be used to endorse or promote products derived -// from this software without specific prior written permission. -// -// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS -// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT -// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR -// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT -// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, -// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT -// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, -// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY -// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT -// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE -// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. - -// See: http://code.google.com/p/v8/issues/detail?id=1878 - -// Flags: --allow-natives-syntax - -var count = 1e5; -var arr = new Array(count); -assertFalse(%HasFastDoubleElements(arr)); -for (var i = 0; i < count; i++) { - arr[i] = 0; -} -assertFalse(%HasFastDoubleElements(arr)); -assertTrue(%HasFastSmiOnlyElements(arr)); diff --git a/test/mjsunit/regress/regress-95113.js b/test/mjsunit/regress/regress-95113.js index 468bff84c2..f01b27004c 100644 --- a/test/mjsunit/regress/regress-95113.js +++ b/test/mjsunit/regress/regress-95113.js @@ -32,7 +32,7 @@ function get_double_array() { var i = 0; while (!%HasFastDoubleElements(a)) { a[i] = i; - i += 0.5; + i++; } assertTrue(%HasFastDoubleElements(a)); a.length = 1;