AuroraMiddleware/v8
1
0
Fork 0
Code Issues 2 Pull Requests Releases Wiki Activity

Ensure the constant operand for heap-object store-named-field is not a smi.

Browse Source 
BUG=
R=jkummerow@chromium.org

Review URL: https://codereview.chromium.org/210193002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@20208 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
This commit is contained in:
verwaest@chromium.org 2014-03-24 16:25:48 +00:00
parent 1da7cb61ca
commit e18e650582
3 changed files with 29 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
src/ia32/lithium-codegen-ia32.cc
View File

@ -4347,7 +4347,7 @@ void LCodeGen::DoStoreNamedField(LStoreNamedField* instr) {
if (representation.IsHeapObject()) {
if (instr->value()->IsConstantOperand()) {
LConstantOperand* operand_value = LConstantOperand::cast(instr->value());
if (IsInteger32(operand_value)) {
if (chunk_->LookupConstant(operand_value)->HasSmiValue()) {
DeoptimizeIf(no_condition, instr->environment());
}
} else {

2
src/x64/lithium-codegen-x64.cc
View File

@ -3953,7 +3953,7 @@ void LCodeGen::DoStoreNamedField(LStoreNamedField* instr) {
if (representation.IsHeapObject()) {
if (instr->value()->IsConstantOperand()) {
LConstantOperand* operand_value = LConstantOperand::cast(instr->value());
if (IsInteger32Constant(operand_value)) {
if (chunk_->LookupConstant(operand_value)->HasSmiValue()) {
DeoptimizeIf(no_condition, instr->environment());
}
} else {

27
test/mjsunit/regress/regress-store-heapobject.js Normal file
View File

@ -0,0 +1,27 @@
// Copyright 2014 the V8 project authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
// Flags: --allow-natives-syntax
var o = {a: undefined};
function store(o, v) {
o.a = v;
}
store(o, undefined);
store(o, undefined);
function f(bool) {
var o = {a: undefined};
if (bool) {
store(o, 1);
}
return o;
}
f(false);
f(false);
%OptimizeFunctionOnNextCall(f);
f(true);