AuroraMiddleware/v8
1
0
Fork 0
Code Issues 2 Pull Requests Releases Wiki Activity

Add missing map check to optimized f.apply(...)

Browse Source 
This is a cutdown version of https://codereview.chromium.org/346473002/, which aimed to fix f.call and f.apply. Optimized f.call was removed by r21887, this is what was left.

BUG=386034
LOG=N
R=bmeurer@chromium.org

Review URL: https://codereview.chromium.org/348623002

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@21907 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
This commit is contained in:
jarin@chromium.org 2014-06-23 05:50:06 +00:00
parent b6b57605ed
commit e56faa9909
2 changed files with 23 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
src/hydrogen.cc
View File

@ -8564,10 +8564,12 @@ bool HOptimizedGraphBuilder::TryCallApply(Call* expr) {
HValue* function = Pop(); // f
Drop(1); // apply
HValue* checked_function = AddCheckMap(function, function_map);
if (function_state()->outer() == NULL) {
HInstruction* elements = Add<HArgumentsElements>(false);
HInstruction* length = Add<HArgumentsLength>(elements);
HValue* wrapped_receiver = BuildWrapReceiver(receiver, function);
HValue* wrapped_receiver = BuildWrapReceiver(receiver, checked_function);
HInstruction* result = New<HApplyArguments>(function,
wrapped_receiver,
length,
@ -8583,7 +8585,7 @@ bool HOptimizedGraphBuilder::TryCallApply(Call* expr) {
const ZoneList<HValue*>* arguments_values = args->arguments_values();
int arguments_count = arguments_values->length();
Push(function);
Push(BuildWrapReceiver(receiver, function));
Push(BuildWrapReceiver(receiver, checked_function));
for (int i = 1; i < arguments_count; i++) {
Push(arguments_values->at(i));
}

19
test/mjsunit/regress/regress-386034.js Normal file
View File

@ -0,0 +1,19 @@
// Copyright 2014 the V8 project authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
// Flags: --allow-natives-syntax
function f(x) {
var v = x;
for (i = 0; i < 1; i++) {
v.apply(this, arguments);
}
}
function g() {}
f(g);
f(g);
%OptimizeFunctionOnNextCall(f);
assertThrows(function() { f('----'); }, TypeError);