AuroraMiddleware/v8
1
0
Fork 0
Code Issues 2 Pull Requests Releases Wiki Activity

Rely on the map being a dictionary map rather than not having a backpointer

Browse Source 
BUG=chromium:500173
LOG=n

Review URL: https://codereview.chromium.org/1194513003

Cr-Commit-Position: refs/heads/master@{#29074}
This commit is contained in:
verwaest 2015-06-17 03:13:48 -07:00 committed by Commit bot
parent 20bc6f530f
commit 72cdb99346
3 changed files with 15 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
src/lookup.cc
View File

@ -236,7 +236,7 @@ void LookupIterator::PrepareTransitionToDataProperty(
Handle<GlobalObject>::cast(receiver), name());
DCHECK(cell->value()->IsTheHole());
transition_ = cell;
} else if (transition->GetBackPointer()->IsMap()) {
} else if (!transition->is_dictionary_map()) {
property_details_ = transition->GetLastDescriptorDetails();
has_property_ = true;
}

3
src/lookup.h
View File

@ -207,7 +207,8 @@ class LookupIterator final BASE_EMBEDDED {
bool IsCacheableTransition() {
if (state_ != TRANSITION) return false;
return transition_->IsPropertyCell() ||
transition_map()->GetBackPointer()->IsMap();
(!transition_map()->is_dictionary_map() &&
transition_map()->GetBackPointer()->IsMap());
}
void ApplyTransitionToDataProperty();
void ReconfigureDataProperty(Handle<Object> value,

12
test/mjsunit/regress/regress-500173.js Normal file
View File

@ -0,0 +1,12 @@
// Copyright 2015 the V8 project authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
function f(a) {
a.foo = {};
a[0] = 1;
a.__defineGetter__('foo', function() {});
a[0] = {};
a.bar = 0;
}
f(new Array());