Revision: 20912
Author: ja...@chromium.org
Date: Wed Apr 23 14:26:53 2014 UTC
Log: Fix the Array.push simulate for non-effect context.
R=da...@google.com, da...@chromium.org
BUG=
Review URL: https://codereview.chromium.org/246543007
http://code.google.com/p/v8/source/detail?r=20912
Added:
/branches/bleeding_edge/test/mjsunit/array-push11.js
Modified:
/branches/bleeding_edge/src/hydrogen.cc
=======================================
--- /dev/null
+++ /branches/bleeding_edge/test/mjsunit/array-push11.js Wed Apr 23
14:26:53 2014 UTC
@@ -0,0 +1,15 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+function __f_17(__v_9) {
+ var __v_10 = 0;
+ var count = 100000;
+ while (count-- != 0) {
+ var l = __v_9.push(0);
+ if (++__v_10 >= 2) return __v_9;
+ __v_10 = {};
+ }
+}
+
+__f_17([]);
=======================================
--- /branches/bleeding_edge/src/hydrogen.cc Wed Apr 23 13:20:28 2014 UTC
+++ /branches/bleeding_edge/src/hydrogen.cc Wed Apr 23 14:26:53 2014 UTC
@@ -7830,7 +7830,10 @@
elements_kind, STORE,
NEVER_RETURN_HOLE,
STORE_AND_GROW_NO_TRANSITION);
+
+ if (!ast_context()->IsEffect()) Push(new_size);
Add<HSimulate>(expr->id(), REMOVABLE_SIMULATE);
+ if (!ast_context()->IsEffect()) Drop(1);
}
ast_context()->ReturnValue(new_size);
--
--
v8-dev mailing list
v8-dev@googlegroups.com
http://groups.google.com/group/v8-dev
---
You received this message because you are subscribed to the Google Groups "v8-dev" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to v8-dev+unsubscr...@googlegroups.com.
For more options, visit https://groups.google.com/d/optout.
