AuroraMiddleware/v8
1
0
Fork 0
Code Issues 2 Pull Requests Releases Wiki Activity

Fix transition conversion from CONSTANT_FUNCTION to FIELD.

Browse Source 
Review URL: https://chromiumcodereview.appspot.com/11094044

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12688 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
This commit is contained in:
verwaest@chromium.org 2012-10-10 12:31:50 +00:00
parent 55e924c595
commit dde1cdfb8e
3 changed files with 48 additions and 21 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
src/objects-printer.cc
View File

@ -254,7 +254,7 @@ void ExternalDoubleArray::ExternalDoubleArrayPrint(FILE* out) {
void JSObject::PrintProperties(FILE* out) {
if (HasFastProperties()) {
DescriptorArray* descs = map()->instance_descriptors();
for (int i = 0; i < descs->number_of_descriptors(); i++) {
for (int i = 0; i < map()->NumberOfOwnDescriptors(); i++) {
PrintF(out, " ");
descs->GetKey(i)->StringPrint(out);
PrintF(out, ": ");

27
src/objects.cc
View File

@ -1771,9 +1771,7 @@ MaybeObject* JSObject::ConvertTransitionToMapTransition(
// If the old_target did not yet store its own descriptors, the new
// descriptors pointer is created for the old_target by temporarily clearing
// the back pointer and setting its descriptor array. The ownership of the
// descriptor array is returned to the smaller maps by installing a reduced
// copy of the descriptor array in the old_map.
// the back pointer and setting its descriptor array.
// This phase is executed before creating the new map since it requires
// allocation that may fail.
@ -1787,8 +1785,6 @@ MaybeObject* JSObject::ConvertTransitionToMapTransition(
// descriptors. Setting the backpointer always succeeds.
old_target->SetBackPointer(old_map);
if (maybe_failure->IsFailure()) return maybe_failure;
old_map->set_owns_descriptors(true);
}
MaybeObject* maybe_result =
@ -1815,18 +1811,6 @@ MaybeObject* JSObject::ConvertTransitionToMapTransition(
new_map->instance_descriptors());
new_map->ClearTransitions(GetHeap());
old_map->set_owns_descriptors(false);
Map* map;
JSGlobalPropertyCell* pointer =
old_map->transitions()->descriptors_pointer();
for (Object* current = old_map;
!current->IsUndefined();
current = map->GetBackPointer()) {
map = Map::cast(current);
if (!map->HasTransitionArray()) break;
TransitionArray* transitions = map->transitions();
if (transitions->descriptors_pointer() != pointer) break;
map->SetEnumLength(Map::kInvalidEnumCache);
}
} else if (old_target->instance_descriptors() ==
old_map->instance_descriptors()) {
// Since the conversion above generated a new fast map with an additional
@ -4995,8 +4979,11 @@ MaybeObject* Map::ShareDescriptor(Descriptor* descriptor) {
// Sanity check. This path is only to be taken if the map owns its descriptor
// array, implying that its NumberOfOwnDescriptors equals the number of
// descriptors in the descriptor array.
ASSERT(NumberOfOwnDescriptors() ==
instance_descriptors()->number_of_descriptors());
if (NumberOfOwnDescriptors() !=
instance_descriptors()->number_of_descriptors()) {
Isolate::Current()->PushStackTraceAndDie(
0xDEAD0002, GetBackPointer(), this, 0xDEAD0003);
}
Map* result;
MaybeObject* maybe_result = CopyDropDescriptors();
if (!maybe_result->To(&result)) return maybe_result;
@ -5086,7 +5073,7 @@ MaybeObject* Map::CopyReplaceDescriptors(DescriptorArray* descriptors,
// If the copied map has no added fields, and the parent map owns its
// descriptors, those descriptors have to be empty. In that case,
// transfer ownership of the descriptors to the new child.
ASSERT(instance_descriptors()->IsEmpty());
CHECK(instance_descriptors()->IsEmpty());
set_owns_descriptors(false);
} else {
// If the parent did not own its own descriptors, it may share a larger

40
test/mjsunit/regress/regress-convert-transition.js Normal file
View File

@ -0,0 +1,40 @@
// Copyright 2012 the V8 project authors. All rights reserved.
// Redistribution and use in source and binary forms, with or without
// modification, are permitted provided that the following conditions are
// met:
//
// * Redistributions of source code must retain the above copyright
// notice, this list of conditions and the following disclaimer.
// * Redistributions in binary form must reproduce the above
// copyright notice, this list of conditions and the following
// disclaimer in the documentation and/or other materials provided
// with the distribution.
// * Neither the name of Google Inc. nor the names of its
// contributors may be used to endorse or promote products derived
// from this software without specific prior written permission.
//
// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
var input = '{ "a1":1, "a2":1, "a3":1, "a4":1, "a5":1, "a6":1, "a7":1,\
"a8":1, "a9":1, "a10":1, "a11":1, "a12":1, "a13":1}';
var a = JSON.parse(input);
a.a = function() { return 10; };
// Force conversion of field to slow mode.
var b = JSON.parse(input);
b.a = 10;
// Add another property to the object that would transition to a.
var c = JSON.parse(input);
c.x = 10;
assertEquals(undefined, c.a);