From 84b366516e1ac474ec085973ecc204549fcfc622 Mon Sep 17 00:00:00 2001 From: "verwaest@chromium.org" Date: Thu, 20 Feb 2014 16:11:48 +0000 Subject: [PATCH] Don't turn objects with empty-string properties into fast-mode. R=ishell@chromium.org Review URL: https://codereview.chromium.org/165743003 git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@19511 ce2b1a6d-e550-0410-aec6-3dcde31c8c00 --- src/objects.cc | 1 + test/mjsunit/regress/regress-fast-empty-string.js | 13 +++++++++++++ 2 files changed, 14 insertions(+) create mode 100644 test/mjsunit/regress/regress-fast-empty-string.js diff --git a/src/objects.cc b/src/objects.cc index 7360172e5b..e459332c76 100644 --- a/src/objects.cc +++ b/src/objects.cc @@ -15710,6 +15710,7 @@ MaybeObject* NameDictionary::TransformPropertiesToFastFor( // instance descriptor. MaybeObject* maybe_key = heap->InternalizeString(String::cast(k)); if (!maybe_key->To(&key)) return maybe_key; + if (key->Equals(heap->empty_string())) return this; } PropertyDetails details = DetailsAt(i); diff --git a/test/mjsunit/regress/regress-fast-empty-string.js b/test/mjsunit/regress/regress-fast-empty-string.js new file mode 100644 index 0000000000..9b9fea963a --- /dev/null +++ b/test/mjsunit/regress/regress-fast-empty-string.js @@ -0,0 +1,13 @@ +// Copyright 2014 the V8 project authors. All rights reserved. +// Use of this source code is governed by a BSD-style license that can be +// found in the LICENSE file. + +var o = {}; +o[""] = 1; +var x = {__proto__:o}; +for (i = 0; i < 3; i++) { + o[""]; +} +for (i = 0; i < 3; i++) { + assertEquals(undefined, o.x); +}