AuroraMiddleware/v8
1
0
Fork 0
Code Issues 2 Pull Requests Releases Wiki Activity

Avoid setting transitions in-place for cached maps when observed

Browse Source 
R=verwaest@chromium.org
BUG=

Review URL: https://codereview.chromium.org/246523004

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@20900 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
This commit is contained in:
jarin@chromium.org 2014-04-23 09:21:24 +00:00
parent e12ae547cf
commit 783eb25a8c
2 changed files with 15 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
src/objects.cc
View File

@ -5816,7 +5816,7 @@ void JSObject::SetObserved(Handle<JSObject> object) {
if (transition_index != TransitionArray::kNotFound) {
new_map = handle(old_map->GetTransition(transition_index), isolate);
ASSERT(new_map->is_observed());
} else if (old_map->CanHaveMoreTransitions()) {
} else if (object->HasFastProperties() && old_map->CanHaveMoreTransitions()) {
new_map = Map::CopyForObserved(old_map);
} else {
new_map = Map::Copy(old_map);

14
test/mjsunit/regress/regress-observe-map-cache.js Normal file
View File

@ -0,0 +1,14 @@
// Copyright 2014 the V8 project authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
// Flags: --allow-natives-syntax --enable-slow-asserts
function f() {
var x = new Array(0);
x[-1] = -1;
Object.observe(x, function() { });
}
f();
f();