AuroraMiddleware/v8
1
0
Fork 0
Code Issues 2 Pull Requests Releases Wiki Activity

Fix representation of Phis for mutable-heapnumber-in-object-literal properties

Browse Source 
BUG=v8:3392
LOG=y
R=verwaest@chromium.org

Review URL: https://codereview.chromium.org/328343004

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@21850 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
This commit is contained in:
jkummerow@chromium.org 2014-06-16 08:41:29 +00:00
parent 712b0a2066
commit aae24ae40b
2 changed files with 19 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
src/hydrogen.cc
View File

@ -11010,7 +11010,7 @@ void HOptimizedGraphBuilder::BuildEmitInObjectProperties(
// 1) it's a child object of another object with a valid allocation site
// 2) we can just use the mode of the parent object for pretenuring
HInstruction* double_box =
Add<HAllocate>(heap_number_constant, HType::HeapNumber(),
Add<HAllocate>(heap_number_constant, HType::HeapObject(),
pretenure_flag, HEAP_NUMBER_TYPE);
AddStoreMapConstant(double_box,
isolate()->factory()->heap_number_map());

18
test/mjsunit/regress/regress-3392.js Normal file
View File

@ -0,0 +1,18 @@
// Copyright 2014 the V8 project authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
// Flags: --allow-natives-syntax
function foo() {
var a = {b: -1.5};
for (var i = 0; i < 1; i++) {
a.b = 1;
}
assertTrue(0 <= a.b);
}
foo();
foo();
%OptimizeFunctionOnNextCall(foo);
foo();