Reviewers: Jakob,
Description:
Fix Kraken regression due to optimistic monomorphic element transitions
[email protected]
Please review this at https://chromiumcodereview.appspot.com/10539141/
SVN Base: https://v8.googlecode.com/svn/branches/bleeding_edge
Affected files:
M src/ic.cc
Index: src/ic.cc
diff --git a/src/ic.cc b/src/ic.cc
index
d7f0f3251c86b20106ba3fba360b80df24563ad9..47a72b495636465761ce27fe4a0d97a107430f78
100644
--- a/src/ic.cc
+++ b/src/ic.cc
@@ -1602,7 +1602,7 @@ Handle<Code> KeyedIC::ComputeStub(Handle<JSObject>
receiver,
monomorphic = true;
} else {
GetReceiverMapsForStub(Handle<Code>(target()), &target_receiver_maps);
- if (ic_state == MONOMORPHIC && is_transition_stub) {
+ if (ic_state == MONOMORPHIC && (is_transition_stub || stub_kind ==
LOAD)) {
// The first time a receiver is seen that is a transitioned version
of the
// previous monomorphic receiver type, assume the new ElementsKind
is the
// monomorphic type. This benefits global arrays that only transition
--
v8-dev mailing list
[email protected]
http://groups.google.com/group/v8-dev
