AuroraMiddleware/v8
1
0
Fork 0
Code Issues 2 Pull Requests Releases Wiki Activity

[elements] revert overzealous optimzation for fast sloppy arguments delete

Browse Source 
BUG=chromium:601390
LOG=n

Review URL: https://codereview.chromium.org/1865343002

Cr-Commit-Position: refs/heads/master@{#35345}
This commit is contained in:
cbruni 2016-04-08 01:02:26 -07:00 committed by Commit bot
parent e39ba01420
commit ad1784e5c6
2 changed files with 71 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
src/elements.cc
View File

@ -1436,7 +1436,9 @@ class FastElementsAccessor : public ElementsAccessorBase<Subclass, KindTraits> {
}
if (entry == 0) {
FixedArray* empty = heap->empty_fixed_array();
if (Subclass::kind() == FAST_SLOPPY_ARGUMENTS_ELEMENTS) {
// Dynamically ask for the elements kind here since we manually redirect
// the operations for argument backing stores.
if (obj->GetElementsKind() == FAST_SLOPPY_ARGUMENTS_ELEMENTS) {
FixedArray::cast(obj->elements())->set(1, empty);
} else {
obj->set_elements(empty);
@ -2356,7 +2358,7 @@ class SloppyArgumentsElementsAccessor
FixedArray* arguments = FixedArray::cast(parameter_map->get(1));
uint32_t entry = ArgumentsAccessor::GetEntryForIndexImpl(holder, arguments,
index, filter);
if (entry == kMaxUInt32) return entry;
if (entry == kMaxUInt32) return kMaxUInt32;
return (parameter_map->length() - 2) + entry;
}

67
test/mjsunit/arguments.js
View File

@ -204,3 +204,70 @@ assertEquals(117, arg_set(0xFFFFFFFF));
}
assertTrue(%HasSloppyArgumentsElements(a));
})();
(function testDeleteArguments() {
function f() { return arguments };
var args = f(1, 2);
assertEquals(1, args[0]);
assertEquals(2, args[1]);
assertEquals(2, args.length);
delete args[0];
assertEquals(undefined, args[0]);
assertEquals(2, args[1]);
assertEquals(2, args.length);
delete args[1];
assertEquals(undefined, args[0]);
assertEquals(undefined, args[1]);
assertEquals(2, args.length);
})();
(function testDeleteFastSloppyArguments() {
function f(a) { return arguments };
var args = f(1, 2);
assertEquals(1, args[0]);
assertEquals(2, args[1]);
assertEquals(2, args.length);
delete args[0];
assertEquals(undefined, args[0]);
assertEquals(2, args[1]);
assertEquals(2, args.length);
delete args[1];
assertEquals(undefined, args[0]);
assertEquals(undefined, args[1]);
assertEquals(2, args.length);
})();
(function testDeleteSlowSloppyArguments() {
var key = 10000;
function f(a) {
arguments[key] = key;
return arguments
};
var args = f(1, 2);
assertEquals(1, args[0]);
assertEquals(2, args[1]);
assertEquals(key, args[key]);
assertEquals(2, args.length);
delete args[0];
assertEquals(undefined, args[0]);
assertEquals(2, args[1]);
assertEquals(key, args[key]);
assertEquals(2, args.length);
delete args[1];
assertEquals(undefined, args[0]);
assertEquals(undefined, args[1]);
assertEquals(key, args[key]);
assertEquals(2, args.length);
delete args[key];
assertEquals(undefined, args[0]);
assertEquals(undefined, args[1]);
assertEquals(undefined, args[key]);
assertEquals(2, args.length);
})();