AuroraMiddleware/v8
1
0
Fork 0
Code Issues 2 Pull Requests Releases Wiki Activity

[keys] Don't keep chain of OrderedHashSets in KeyAccumulator

Browse Source 
Bug: chromium:831984
Change-Id: Ie13b22bc2491acc255557ba0325d8d53c22d6acb
Reviewed-on: https://chromium-review.googlesource.com/1012874
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Commit-Queue: Camillo Bruni <cbruni@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52630}
This commit is contained in:
Camillo Bruni 2018-04-16 11:24:20 -07:00 committed by Commit Bot
parent c536ea2dba
commit 7bb79b96bd
2 changed files with 18 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
src/keys.cc
View File

@ -77,7 +77,14 @@ void KeyAccumulator::AddKey(Handle<Object> key, AddKeyConversion convert) {
Handle<String>::cast(key)->AsArrayIndex(&index)) {
key = isolate_->factory()->NewNumberFromUint(index);
}
keys_ = OrderedHashSet::Add(keys(), key);
Handle<OrderedHashSet> new_set = OrderedHashSet::Add(keys(), key);
if (*new_set != *keys_) {
// The keys_ Set is converted directly to a FixedArray in GetKeys which can
// be left-trimmer. Hence the previous Set should not keep a pointer to the
// new one.
keys_->set(OrderedHashTableBase::kNextTableIndex, Smi::kZero);
keys_ = new_set;
}
}
void KeyAccumulator::AddKeys(Handle<FixedArray> array,

10
test/mjsunit/regress/regress-crbug-831984.js Normal file
View File

@ -0,0 +1,10 @@
// Copyright 2018 the V8 project authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
let arr = [...Array(9000)];
for (let j = 0; j < 40; j++) {
Reflect.ownKeys(arr).shift();
Array(64386);
}