Reviewers: Toon Verwaest,
Description:
Merged r16597 into trunk branch.
Put js accessor ics behind a flags until fixed
R=verwa...@chromium.org
BUG=chromium:287879
Please review this at https://codereview.chromium.org/23816012/
SVN Base: https://v8.googlecode.com/svn/trunk
Affected files (+23, -4 lines):
M src/flag-definitions.h
M src/ic.cc
M src/version.cc
M test/cctest/test-accessors.cc
Index: src/flag-definitions.h
diff --git a/src/flag-definitions.h b/src/flag-definitions.h
index
d47e9b1aecaeb772baf40cd0142c7efd3f7d493b..2b4f72d5f3ef85e2f32ae7ecd4b9ec7154fd1530
100644
--- a/src/flag-definitions.h
+++ b/src/flag-definitions.h
@@ -545,6 +545,7 @@ DEFINE_bool(use_idle_notification, true,
"Use idle notification to reduce memory footprint.")
// ic.cc
DEFINE_bool(use_ic, true, "use inline caching")
+DEFINE_bool(js_accessor_ics, false, "create ics for js accessors")
// macro-assembler-ia32.cc
DEFINE_bool(native_code_counters, false,
Index: src/ic.cc
diff --git a/src/ic.cc b/src/ic.cc
index
9724c446e1f4d8e640ed55c204b9a7f7b2224c37..7211ad91679dc199abc4b704406731efa13a10c7
100644
--- a/src/ic.cc
+++ b/src/ic.cc
@@ -1360,7 +1360,8 @@ Handle<Code> LoadIC::ComputeLoadHandler(LookupResult*
lookup,
Handle<JSFunction> function = Handle<JSFunction>::cast(getter);
CallOptimization call_optimization(function);
if (call_optimization.is_simple_api_call() &&
- call_optimization.IsCompatibleReceiver(*receiver)) {
+ call_optimization.IsCompatibleReceiver(*receiver) &&
+ FLAG_js_accessor_ics) {
return isolate()->stub_cache()->ComputeLoadCallback(
name, receiver, holder, call_optimization);
}
@@ -1568,7 +1569,8 @@ Handle<Code>
KeyedLoadIC::ComputeLoadHandler(LookupResult* lookup,
Handle<JSFunction> function = Handle<JSFunction>::cast(getter);
CallOptimization call_optimization(function);
if (call_optimization.is_simple_api_call() &&
- call_optimization.IsCompatibleReceiver(*receiver)) {
+ call_optimization.IsCompatibleReceiver(*receiver) &&
+ FLAG_js_accessor_ics) {
return isolate()->stub_cache()->ComputeKeyedLoadCallback(
name, receiver, holder, call_optimization);
}
@@ -1834,7 +1836,8 @@ Handle<Code>
StoreIC::ComputeStoreMonomorphic(LookupResult* lookup,
Handle<JSFunction> function = Handle<JSFunction>::cast(setter);
CallOptimization call_optimization(function);
if (call_optimization.is_simple_api_call() &&
- call_optimization.IsCompatibleReceiver(*receiver)) {
+ call_optimization.IsCompatibleReceiver(*receiver) &&
+ FLAG_js_accessor_ics) {
return isolate()->stub_cache()->ComputeStoreCallback(
name, receiver, holder, call_optimization, strict_mode);
}
Index: src/version.cc
diff --git a/src/version.cc b/src/version.cc
index
9b59e2a603f785c601e42e63d81ee7a59b048f8e..76391256dacba84cfd034776c6fd6a9836058922
100644
--- a/src/version.cc
+++ b/src/version.cc
@@ -35,7 +35,7 @@
#define MAJOR_VERSION 3
#define MINOR_VERSION 21
#define BUILD_NUMBER 12
-#define PATCH_LEVEL 0
+#define PATCH_LEVEL 1
// Use 1 for candidates and 0 otherwise.
// (Boolean macro values are not supported by all preprocessors.)
#define IS_CANDIDATE_VERSION 0
Index: test/cctest/test-accessors.cc
diff --git a/test/cctest/test-accessors.cc b/test/cctest/test-accessors.cc
index
09b0644b36758ee7a1a3d42eb619e13d47f8296b..2aaac922bfbe2e49d22766727e126e6adefec235
100644
--- a/test/cctest/test-accessors.cc
+++ b/test/cctest/test-accessors.cc
@@ -552,3 +552,18 @@ THREADED_TEST(JSONStringifyNamedInterceptorObject) {
v8::Handle<v8::String> expected =
v8_str("{\"regress\":\"crbug-161028\"}");
CHECK(CompileRun("JSON.stringify(obj)")->Equals(expected));
}
+
+
+THREADED_TEST(CrossContextAccess) {
+ LocalContext env;
+ v8::Isolate* isolate = env->GetIsolate();
+ v8::HandleScope scope(isolate);
+ v8::Handle<v8::Function> fun = v8::Function::New(isolate,
handle_property);
+ LocalContext switch_context;
+ switch_context->Global()->Set(v8_str("fun"), fun);
+ v8::TryCatch try_catch;
+ CompileRun(
+ "var o = Object.create(null, { n: { get:fun } });"
+ "for (var i = 0; i < 10; i++) o.n;");
+ CHECK(!try_catch.HasCaught());
+}
--
--
v8-dev mailing list
v8-dev@googlegroups.com
http://groups.google.com/group/v8-dev
---
You received this message because you are subscribed to the Google Groups "v8-dev" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to v8-dev+unsubscr...@googlegroups.com.
For more options, visit https://groups.google.com/groups/opt_out.
