AuroraMiddleware/v8
1
0
Fork 0
Code Issues 2 Pull Requests Releases Wiki Activity

[runtime] Follow-up fix for "Better encapsulation of dictionary objects handling in lookup iterator."

Browse Source 
BUG=chromium:626715

Review-Url: https://codereview.chromium.org/2135253002
Cr-Commit-Position: refs/heads/master@{#37651}
This commit is contained in:
ishell 2016-07-11 08:48:54 -07:00 committed by Commit bot
parent d8d75782fb
commit b030a6f59d
2 changed files with 33 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
src/lookup.cc
View File

@ -356,7 +356,11 @@ void LookupIterator::PrepareTransitionToDataProperty(
state_ = TRANSITION;
transition_ = transition;
if (!transition->is_dictionary_map()) {
if (transition->is_dictionary_map()) {
// Don't set enumeration index (it will be set during value store).
property_details_ =
PropertyDetails(attributes, i::DATA, 0, PropertyCellType::kNoCell);
} else {
property_details_ = transition->GetLastDescriptorDetails();
has_property_ = true;
}

28
test/mjsunit/regress/regress-crbug-626715.js Normal file
View File

@ -0,0 +1,28 @@
// Copyright 2016 the V8 project authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
// Create a prototype object which has a lot of fast properties.
var body = "";
for (var i = 0; i < 100; i++) {
body += `this.a${i} = 0;\n`;
}
var Proto = new Function(body);
function A() {}
A.prototype = new Proto();
// Create a object and add properties that already exist in the prototype.
// At some point the object will turn into a dictionary mode and one of
// the fast details from the prototype will be reinterpreted as a details
// for a new property ...
var o = new A();
for (var i = 0; i < 100; i++) {
o["a" + i] = i;
}
// ... which will break the enumeration order of the slow properties.
var names = Object.getOwnPropertyNames(o);
for (var i = 0; i < 100; i++) {
assertEquals("a" + i, names[i]);
}