AuroraMiddleware/v8
1
0
Fork 0
Code Issues 2 Pull Requests Releases Wiki Activity

Fix polymorphic keyed loads for SLOPPY_ARGUMENTS_ELEMENTS

Browse Source 
BUG=chromium:350867
LOG=y
R=verwaest@chromium.org

Review URL: https://codereview.chromium.org/203303010

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@20087 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
This commit is contained in:
jkummerow@chromium.org 2014-03-19 15:49:29 +00:00
parent 21e09fa8dd
commit d9b6b6439d
3 changed files with 17 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
src/ic.cc
View File

@ -1096,7 +1096,6 @@ MaybeObject* KeyedLoadIC::Load(Handle<Object> object, Handle<Object> key) {
maybe_object = LoadIC::Load(object, Handle<String>::cast(key));
if (maybe_object->IsFailure()) return maybe_object;
} else if (FLAG_use_ic && !object->IsAccessCheckNeeded()) {
ASSERT(!object->IsAccessCheckNeeded());
if (object->IsString() && key->IsNumber()) {
if (state() == UNINITIALIZED) stub = string_stub();
} else if (object->IsJSObject()) {
@ -1117,7 +1116,6 @@ MaybeObject* KeyedLoadIC::Load(Handle<Object> object, Handle<Object> key) {
if (*stub == *generic_stub()) {
TRACE_GENERIC_IC(isolate(), "KeyedLoadIC", "set generic");
}
ASSERT(!stub.is_null());
set_target(*stub);
TRACE_IC("LoadIC", key);
}

2
src/stub-cache.cc
View File

@ -1306,6 +1306,8 @@ void KeyedLoadStubCompiler::CompileElementHandlers(MapHandleList* receiver_maps,
cached_stub =
KeyedLoadFastElementStub(is_js_array,
elements_kind).GetCode(isolate());
} else if (elements_kind == SLOPPY_ARGUMENTS_ELEMENTS) {
cached_stub = isolate()->builtins()->KeyedLoadIC_SloppyArguments();
} else {
ASSERT(elements_kind == DICTIONARY_ELEMENTS);
cached_stub = KeyedLoadDictionaryElementStub().GetCode(isolate());

15
test/mjsunit/regress/regress-crbug-350867.js Normal file
View File

@ -0,0 +1,15 @@
// Copyright 2014 the V8 project authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
function f1(a, i) {
return a[i];
}
function f2(a, b, c, index) {
return f1(arguments, index);
}
f2(2, 3, 4, "foo");
f2(2, 3, 4, "foo");
assertEquals(11, f1([11, 22, 33], 0));
assertEquals(22, f2(22, 33, 44, 0));