AuroraMiddleware/v8
1
0
Fork 0
Code Issues 2 Pull Requests Releases Wiki Activity

[turbofan] Set elements kind to holey if constructing array of possibly non-zero length.

Browse Source 
BUG=chromium:621147

Review-Url: https://codereview.chromium.org/2126623003
Cr-Commit-Position: refs/heads/master@{#37543}
This commit is contained in:
jarin 2016-07-06 00:54:11 -07:00 committed by Commit bot
parent 0ff1ca3f1f
commit 7614362b7e
2 changed files with 32 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
src/compiler/js-create-lowering.cc
View File

@ -473,6 +473,9 @@ Reduction JSCreateLowering::ReduceNewArray(Node* node, Node* length,
PretenureFlag pretenure = site->GetPretenureMode();
ElementsKind elements_kind = site->GetElementsKind();
DCHECK(IsFastElementsKind(elements_kind));
if (NodeProperties::GetType(length)->Max() > 0) {
elements_kind = GetHoleyElementsKind(elements_kind);
}
dependencies()->AssumeTenuringDecision(site);
dependencies()->AssumeTransitionStable(site);

29
test/mjsunit/compiler/regress-621147.js Normal file
View File

@ -0,0 +1,29 @@
// Copyright 2014 the V8 project authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
// Flags: --allow-natives-syntax --turbo-filter=test2
function test(n) {
return Array(n);
}
function test2() {
return test(2);
}
function test3(a) {
a[0] = 1;
}
test(0);
var smi_array = [1,2];
smi_array[2] = 3;
test3(smi_array);
%OptimizeFunctionOnNextCall(test2);
var broken_array = test2();
test3(broken_array);
1+broken_array[0];