AuroraMiddleware/v8
1
0
Fork 0
Code Issues 2 Pull Requests Releases Wiki Activity

Don't EnsureHasInitialMap on non-constructors.

Browse Source 
non-constructors are not allowed to have initial maps. The optimizing compilers used to add initial maps unconditionally to functions used as right-hand-side in instanceof.

BUG=

Review URL: https://codereview.chromium.org/1490003003

Cr-Commit-Position: refs/heads/master@{#32497}
This commit is contained in:
verwaest 2015-12-02 02:39:33 -08:00 committed by Commit bot
parent e478a8ac39
commit 9bee67509c
4 changed files with 27 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
src/compiler/js-typed-lowering.cc
View File

@ -1150,7 +1150,8 @@ Reduction JSTypedLowering::ReduceJSInstanceOf(Node* node) {
Handle<JSFunction> function =
Handle<JSFunction>::cast(r.right_type()->AsConstant()->Value());
Handle<SharedFunctionInfo> shared(function->shared(), isolate());
if (!function->map()->has_non_instance_prototype()) {
if (function->IsConstructor() &&
!function->map()->has_non_instance_prototype()) {
JSFunction::EnsureHasInitialMap(function);
DCHECK(function->has_initial_map());
Handle<Map> initial_map(function->initial_map(), isolate());

3
src/crankshaft/hydrogen.cc
View File

@ -11459,7 +11459,8 @@ void HOptimizedGraphBuilder::VisitCompareOperation(CompareOperation* expr) {
HConstant::cast(right)->handle(isolate())->IsJSFunction()) {
Handle<JSFunction> constructor =
Handle<JSFunction>::cast(HConstant::cast(right)->handle(isolate()));
if (!constructor->map()->has_non_instance_prototype()) {
if (constructor->IsConstructor() &&
!constructor->map()->has_non_instance_prototype()) {
JSFunction::EnsureHasInitialMap(constructor);
DCHECK(constructor->has_initial_map());
Handle<Map> initial_map(constructor->initial_map(), isolate());

1
src/objects.cc
View File

@ -12524,6 +12524,7 @@ bool CanSubclassHaveInobjectProperties(InstanceType instance_type) {
void JSFunction::EnsureHasInitialMap(Handle<JSFunction> function) {
DCHECK(function->IsConstructor() || function->shared()->is_generator());
if (function->has_initial_map()) return;
Isolate* isolate = function->GetIsolate();

22
test/mjsunit/regress/regress-ensure-initial-map.js Normal file
View File

@ -0,0 +1,22 @@
// Copyright 2015 the V8 project authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
// Flags: --allow-natives-syntax
var x = Object.getOwnPropertyDescriptor({get x() {}}, "x").get;
function f(o, b) {
if (b) {
return o instanceof x;
}
}
%OptimizeFunctionOnNextCall(f);
f();
function g() {
return new x();
}
%OptimizeFunctionOnNextCall(g);
assertThrows(()=>g());