AuroraMiddleware/v8
1
0
Fork 0
Code Issues 2 Pull Requests Releases Wiki Activity

Fix IC cache confusion on String.prototype.length

Browse Source 
BUG=416416
LOG=N
R=jarin@chromium.org

Review URL: https://codereview.chromium.org/587363002

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@24174 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
This commit is contained in:
mvstanton@chromium.org 2014-09-24 09:33:04 +00:00
parent aeae854827
commit b0b59073ac
2 changed files with 22 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
src/ic/ic.cc
View File

@ -929,7 +929,14 @@ Handle<Code> IC::ComputeHandler(LookupIterator* lookup, Handle<Object> value) {
code = CompileHandler(lookup, value, flag);
DCHECK(code->is_handler());
if (code->type() != Code::NORMAL) {
// TODO(mvstanton): we'd only like to cache code on the map when it's custom
// code compiled for this map, otherwise it's already cached in the global
// code
// cache. We are also guarding against installing code with flags that don't
// match the desired CacheHolderFlag computed above, which would lead to
// invalid lookups later.
if (code->type() != Code::NORMAL &&
Code::ExtractCacheHolderFromFlags(code->flags()) == flag) {
Map::UpdateCodeCache(stub_holder_map, lookup->name(), code);
}

14
test/mjsunit/regress/regress-416416.js Normal file
View File

@ -0,0 +1,14 @@
// Copyright 2014 the V8 project authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
function foo() {
try {
String.prototype.length.x();
} catch (e) {
}
}
foo();
foo();
foo();