AuroraMiddleware/v8
1
0
Fork 0
Code Issues 2 Pull Requests Releases Wiki Activity

Set the proper instance-type on HAllocate in BuildFastLiteral

Browse Source 
BUG=chromium:284577
R=hpayer@chromium.org

Review URL: https://chromiumcodereview.appspot.com/23480094

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@16790 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
This commit is contained in:
verwaest@chromium.org 2013-09-18 14:14:55 +00:00
parent eca42c42cb
commit 8c0c573d96
1 changed files with 7 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
src/hydrogen.cc
View File

@ -8196,8 +8196,9 @@ HInstruction* HOptimizedGraphBuilder::BuildFastLiteral(
int object_size = boilerplate_object->map()->instance_size();
int object_offset = object_size;
InstanceType instance_type = boilerplate_object->map()->instance_type();
bool create_allocation_site_info = mode == TRACK_ALLOCATION_SITE &&
AllocationSite::CanTrack(boilerplate_object->map()->instance_type());
AllocationSite::CanTrack(instance_type);
// If using allocation sites, then the payload on the site should already
// be filled in as a valid (boilerplate) array.
@ -8208,9 +8209,12 @@ HInstruction* HOptimizedGraphBuilder::BuildFastLiteral(
object_size += AllocationMemento::kSize;
}
ASSERT(instance_type == JS_ARRAY_TYPE || instance_type == JS_OBJECT_TYPE);
HType type = instance_type == JS_ARRAY_TYPE
? HType::JSArray() : HType::JSObject();
HValue* object_size_constant = Add<HConstant>(object_size);
HInstruction* object = Add<HAllocate>(object_size_constant, HType::JSObject(),
isolate()->heap()->GetPretenureMode(), JS_OBJECT_TYPE);
HInstruction* object = Add<HAllocate>(object_size_constant, type,
isolate()->heap()->GetPretenureMode(), instance_type);
BuildEmitObjectHeader(boilerplate_object, object);