AuroraMiddleware/v8
1
0
Fork 0
Code Issues 2 Pull Requests Releases Wiki Activity

[promises] Don't allocate new array before filling up existing array

Browse Source 
Previously we created 3 FixedArrays and then filled them up with
values. This meant that during the creation of the second and third
FixedArray, there were one and two FixedArrays respectively, without
any values in it which broke the FixedArrayVerify.

This patch fills each FixedArray with the correct values before
creating new ones.

BUG=chromium:672051

Review-Url: https://codereview.chromium.org/2554323003
Cr-Commit-Position: refs/heads/master@{#41564}
This commit is contained in:
gsathya 2016-12-07 12:50:57 -08:00 committed by Commit bot
parent 93b87c89f2
commit 87b84a341d
1 changed files with 9 additions and 10 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

19
src/builtins/builtins-promise.cc
View File

@ -479,26 +479,25 @@ compiler::Node* InternalPerformPromiseThen(CodeStubAssembler* a,
a->Bind(&if_singlecallback);
{
// Create new FixedArrays to store callbacks.
// Create new FixedArrays to store callbacks, and migrate
// existing callbacks.
Node* const deferreds =
a->AllocateFixedArray(FAST_ELEMENTS, a->Int32Constant(2));
a->StoreFixedArrayElement(deferreds, 0, existing_deferred);
a->StoreFixedArrayElement(deferreds, 1, deferred);
Node* const fulfill_reactions =
a->AllocateFixedArray(FAST_ELEMENTS, a->Int32Constant(2));
Node* const reject_reactions =
a->AllocateFixedArray(FAST_ELEMENTS, a->Int32Constant(2));
// Store existing callbacks in FixedArrays.
a->StoreFixedArrayElement(deferreds, 0, existing_deferred);
a->StoreFixedArrayElement(
fulfill_reactions, 0,
a->LoadObjectField(promise, JSPromise::kFulfillReactionsOffset));
a->StoreFixedArrayElement(fulfill_reactions, 1, var_on_resolve.value());
Node* const reject_reactions =
a->AllocateFixedArray(FAST_ELEMENTS, a->Int32Constant(2));
a->StoreFixedArrayElement(
reject_reactions, 0,
a->LoadObjectField(promise, JSPromise::kRejectReactionsOffset));
// Store new callbacks in FixedArrays.
a->StoreFixedArrayElement(deferreds, 1, deferred);
a->StoreFixedArrayElement(fulfill_reactions, 1, var_on_resolve.value());
a->StoreFixedArrayElement(reject_reactions, 1, var_on_reject.value());
// Store new FixedArrays in promise.