AuroraMiddleware/v8
1
0
Fork 0
Code Issues 2 Pull Requests Releases Wiki Activity

Bug: Runtime_GrowArrayElements provoked unnecessary lazy deopt.

Browse Source 
Unnecessary, and unhandled as well.

BUG=488398
R=jarin@chromium.org
LOG=N

Review URL: https://codereview.chromium.org/1141163004

Cr-Commit-Position: refs/heads/master@{#28421}
This commit is contained in:
mvstanton 2015-05-15 06:05:08 -07:00 committed by Commit bot
parent 50ccb14913
commit de3a1ca02e
2 changed files with 20 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
src/runtime/runtime-array.cc
View File

@ -1254,7 +1254,8 @@ RUNTIME_FUNCTION(Runtime_GrowArrayElements) {
if (index >= capacity) {
if (object->WouldConvertToSlowElements(index)) {
JSObject::NormalizeElements(object);
// We don't want to allow operations that cause lazy deopt. Return a Smi
// as a signal that optimized code should eagerly deoptimize.
return Smi::FromInt(0);
}

18
test/mjsunit/regress/regress-488398.js Normal file
View File

@ -0,0 +1,18 @@
// Copyright 2015 the V8 project authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
// Flags: --allow-natives-syntax
var __v_10 = 4294967295;
__v_0 = [];
__v_0.__proto__ = [];
__v_16 = __v_0;
function __f_17(__v_16, base) {
__v_16[base + 1] = 1;
__v_16[base + 4] = base + 4;
}
__f_17(__v_16, true);
__f_17(__v_16, 14);
%OptimizeFunctionOnNextCall(__f_17);
__f_17(__v_16, 2048);