AuroraMiddleware/v8
1
0
Fork 0
Code Issues 2 Pull Requests Releases Wiki Activity

Invalidate the global property cell when converting from data to accessor.

Browse Source 
BUG=
TBR=jkummerow@chromium.org,

Review URL: https://codereview.chromium.org/961003002

Cr-Commit-Position: refs/heads/master@{#26896}
This commit is contained in:
verwaest 2015-02-26 10:48:48 -08:00 committed by Commit bot
parent fa293dd79f
commit 6a12dc240b
3 changed files with 26 additions and 8 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
src/ic/handler-compiler.h
View File

@ -95,7 +95,7 @@ class PropertyHandlerCompiler : public PropertyAccessCompiler {
Register CheckPrototypes(Register object_reg, Register holder_reg,
Register scratch1, Register scratch2,
Handle<Name> name, Label* miss,
PrototypeCheckType check = CHECK_ALL_MAPS);
PrototypeCheckType check);
Handle<Code> GetCode(Code::Kind kind, Code::StubType type, Handle<Name> name);
void set_holder(Handle<JSObject> holder) { holder_ = holder; }

17
src/objects.cc
View File

@ -565,7 +565,15 @@ void JSObject::SetNormalizedProperty(Handle<JSObject> object,
if (object->IsGlobalObject()) {
Handle<PropertyCell> cell(
PropertyCell::cast(property_dictionary->ValueAt(entry)));
PropertyCell::SetValueInferType(cell, value);
if (details.type() != property_dictionary->DetailsAt(entry).type()) {
Isolate* isolate = object->GetIsolate();
Handle<Object> hole = isolate->factory()->the_hole_value();
PropertyCell::SetValueInferType(cell, hole);
cell = isolate->factory()->NewPropertyCell(value);
property_dictionary->SetEntry(entry, name, cell, details);
} else {
PropertyCell::SetValueInferType(cell, value);
}
// Please note we have to update the property details.
property_dictionary->DetailsAtPut(entry, details);
} else {
@ -7432,12 +7440,7 @@ Handle<Map> Map::TransitionToAccessorProperty(Handle<Map> map,
Isolate* isolate = name->GetIsolate();
// Dictionary maps can always have additional data properties.
if (map->is_dictionary_map()) {
// For global objects, property cells are inlined. We need to change the
// map.
if (map->IsGlobalObjectMap()) return Copy(map, "GlobalAccessor");
return map;
}
if (map->is_dictionary_map()) return map;
// Migrate to the newest map before transitioning to the new property.
map = Update(map);

15
test/mjsunit/regress/convert-global-data-to-accessor.js Normal file
View File

@ -0,0 +1,15 @@
// Copyright 2015 the V8 project authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
function f(o) {
return o.x;
}
this.x = 100;
f(this);
f(this);
f(this);
Object.defineProperty(this, 'x', { get: function() { return 10; }});
assertEquals(10, this.x);
assertEquals(10, f(this));