AuroraMiddleware/v8
1
0
Fork 0
Code Issues 2 Pull Requests Releases Wiki Activity

Fix the Array.push simulate for non-effect context.

Browse Source 
R=danno@google.com, danno@chromium.org
BUG=

Review URL: https://codereview.chromium.org/246543007

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@20912 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
This commit is contained in:
jarin@chromium.org 2014-04-23 14:26:53 +00:00
parent 2aa8941ad4
commit cd3b9b8950
2 changed files with 18 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
src/hydrogen.cc
View File

@ -7830,7 +7830,10 @@ bool HOptimizedGraphBuilder::TryInlineBuiltinMethodCall(
elements_kind, STORE,
NEVER_RETURN_HOLE,
STORE_AND_GROW_NO_TRANSITION);
if (!ast_context()->IsEffect()) Push(new_size);
Add<HSimulate>(expr->id(), REMOVABLE_SIMULATE);
if (!ast_context()->IsEffect()) Drop(1);
}
ast_context()->ReturnValue(new_size);

15
test/mjsunit/array-push11.js Normal file
View File

@ -0,0 +1,15 @@
// Copyright 2014 the V8 project authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
function __f_17(__v_9) {
var __v_10 = 0;
var count = 100000;
while (count-- != 0) {
var l = __v_9.push(0);
if (++__v_10 >= 2) return __v_9;
__v_10 = {};
}
}
__f_17([]);