Reviewers: Toon Verwaest,
Description:
Fix bug in regexp result object construction.
R=verwa...@chromium.org
BUG=
Please review this at https://codereview.chromium.org/23548018/
SVN Base: https://v8.googlecode.com/svn/branches/bleeding_edge
Affected files (+15, -14 lines):
M src/runtime.cc
A + test/mjsunit/regress/regress-regexp-construct-result.js
Index: src/runtime.cc
diff --git a/src/runtime.cc b/src/runtime.cc
index
f51b6878244545df68437498b6039ec0f793664a..9e44b586bd36e48807fb6a989f264d11681f0edd
100644
--- a/src/runtime.cc
+++ b/src/runtime.cc
@@ -2469,7 +2469,7 @@ RUNTIME_FUNCTION(MaybeObject*,
Runtime_RegExpConstructResult) {
}
Object* new_object;
{ MaybeObject* maybe_new_object =
- isolate->heap()->AllocateFixedArrayWithHoles(elements_count);
+ isolate->heap()->AllocateFixedArray(elements_count);
if (!maybe_new_object->ToObject(&new_object)) return maybe_new_object;
}
FixedArray* elements = FixedArray::cast(new_object);
Index: test/mjsunit/regress/regress-regexp-construct-result.js
diff --git a/test/mjsunit/compiler/osr-with-args.js
b/test/mjsunit/regress/regress-regexp-construct-result.js
similarity index 72%
copy from test/mjsunit/compiler/osr-with-args.js
copy to test/mjsunit/regress/regress-regexp-construct-result.js
index
44fa1cb2cf9d0a1fcf3689b03fc01cc4e9f4eafc..84bdd2004bbd91d6f9ef8bf6a42ee8586c1a5abe
100644
--- a/test/mjsunit/compiler/osr-with-args.js
+++ b/test/mjsunit/regress/regress-regexp-construct-result.js
@@ -25,20 +25,21 @@
// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
-// Flags: --use-osr
+// Create a huge regexp with many alternative capture groups, most of
+// which do not capture anything, but the corresponding capture slot
+// in the result object has to exist, even though filled with undefined.
+// Having a large result array helps stressing GC.
-function f() {
- var sum = 0;
- for (var i = 0; i < 1000000; i++) {
- var t = arguments[0] + 2;
- var x = arguments[1] + 2;
- var y = t + x + 5;
- var z = y + 3;
- sum += z;
- }
- return sum;
+var num_captures = 1000;
+var regexp_string = "(a)";
+for (var i = 0; i < num_captures - 1; i++) {
+ regexp_string += "|(b)";
}
+var regexp = new RegExp(regexp_string);
-for (var i = 0; i < 4; i++) {
- assertEquals(17000000, f(2, 3));
+for (var i = 0; i < 10; i++) {
+ var matches = regexp.exec("a");
+ var count = 0;
+ matches.forEach(function() { count++; });
+ assertEquals(num_captures + 1, count);
}
--
--
v8-dev mailing list
v8-dev@googlegroups.com
http://groups.google.com/group/v8-dev
---
You received this message because you are subscribed to the Google Groups "v8-dev" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to v8-dev+unsubscr...@googlegroups.com.
For more options, visit https://groups.google.com/groups/opt_out.
