Eliminated manual allocation folding in BuildCloneShallowArray.

BUG=
R=mstarzinger@chromium.org

Review URL: https://codereview.chromium.org/23038003

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@16359 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
This commit is contained in:
hpayer@chromium.org 2013-08-27 13:39:52 +00:00
parent 9d8684f8de
commit 6379e5dc41

View File

@ -1708,22 +1708,12 @@ HValue* HGraphBuilder::BuildCloneShallowArray(HValue* boilerplate,
if (mode == TRACK_ALLOCATION_SITE) {
size += AllocationMemento::kSize;
}
int elems_offset = size;
InstanceType instance_type = IsFastDoubleElementsKind(kind) ?
FIXED_DOUBLE_ARRAY_TYPE : FIXED_ARRAY_TYPE;
if (length > 0) {
size += IsFastDoubleElementsKind(kind)
? FixedDoubleArray::SizeFor(length)
: FixedArray::SizeFor(length);
}
// Allocate both the JS array and the elements array in one big
// allocation. This avoids multiple limit checks.
HValue* size_in_bytes = Add<HConstant>(size);
HInstruction* object = Add<HAllocate>(size_in_bytes,
HType::JSObject(),
NOT_TENURED,
instance_type);
JS_OBJECT_TYPE);
// Copy the JS array part.
for (int i = 0; i < JSArray::kSize; i += kPointerSize) {
@ -1740,10 +1730,17 @@ HValue* HGraphBuilder::BuildCloneShallowArray(HValue* boilerplate,
}
if (length > 0) {
// Get hold of the elements array of the boilerplate and setup the
// elements pointer in the resulting object.
HValue* boilerplate_elements = AddLoadElements(boilerplate);
HValue* object_elements = Add<HInnerAllocatedObject>(object, elems_offset);
HValue* object_elements;
if (IsFastDoubleElementsKind(kind)) {
HValue* elems_size = Add<HConstant>(FixedDoubleArray::SizeFor(length));
object_elements = Add<HAllocate>(elems_size, HType::JSArray(),
NOT_TENURED, FIXED_DOUBLE_ARRAY_TYPE);
} else {
HValue* elems_size = Add<HConstant>(FixedArray::SizeFor(length));
object_elements = Add<HAllocate>(elems_size, HType::JSArray(),
NOT_TENURED, FIXED_ARRAY_TYPE);
}
Add<HStoreNamedField>(object, HObjectAccess::ForElementsPointer(),
object_elements);