Reviewers: mvstanton,
Message:
Committed patchset #1 manually as r19595 (tree was closed).
Description:
Get array_function from NativeContext
[email protected]
LOG=N
BUG=347528
Committed: https://code.google.com/p/v8/source/detail?r=19595
Please review this at https://codereview.chromium.org/184173003/
SVN Base: https://v8.googlecode.com/svn/branches/bleeding_edge
Affected files (+16, -15 lines):
M src/hydrogen.cc
M src/type-info.cc
A + test/mjsunit/regress/regress-crbug-347528.js
Index: src/hydrogen.cc
diff --git a/src/hydrogen.cc b/src/hydrogen.cc
index
6bc7f6982fb798f442eb5a55da8b380ac7868d0c..7dcd39d5e275033a2819535e82c3ae2323fb893c
100644
--- a/src/hydrogen.cc
+++ b/src/hydrogen.cc
@@ -8216,16 +8216,17 @@ static bool
IsAllocationInlineable(Handle<JSFunction> constructor) {
bool HOptimizedGraphBuilder::IsCallNewArrayInlineable(CallNew* expr) {
- bool inline_ok = false;
+ Handle<AllocationSite> site = expr->allocation_site();
+ if (site.is_null()) return false;
+
Handle<JSFunction> caller = current_info()->closure();
- Handle<JSFunction> target(isolate()->global_context()->array_function(),
+ Handle<JSFunction> target(isolate()->native_context()->array_function(),
isolate());
int argument_count = expr->arguments()->length();
// We should have the function plus array arguments on the environment
stack.
ASSERT(environment()->length() >= (argument_count + 1));
- Handle<AllocationSite> site = expr->allocation_site();
- ASSERT(!site.is_null());
+ bool inline_ok = false;
if (site->CanInlineCall()) {
// We also want to avoid inlining in certain 1 argument scenarios.
if (argument_count == 1) {
@@ -8365,7 +8366,7 @@ void HOptimizedGraphBuilder::VisitCallNew(CallNew*
expr) {
// The constructor function is both an operand to the instruction and
an
// argument to the construct call.
Handle<JSFunction> array_function(
- isolate()->global_context()->array_function(), isolate());
+ isolate()->native_context()->array_function(), isolate());
bool use_call_new_array =
expr->target().is_identical_to(array_function);
if (use_call_new_array && IsCallNewArrayInlineable(expr)) {
// Verify we are still calling the array function for our native
context.
Index: src/type-info.cc
diff --git a/src/type-info.cc b/src/type-info.cc
index
7372693dfa6a59bdf6b9a2b41bf9fbce993c470d..f17ea0d54ee3f20a2ba0aa495be518c390594e60
100644
--- a/src/type-info.cc
+++ b/src/type-info.cc
@@ -154,7 +154,7 @@ KeyedAccessStoreMode TypeFeedbackOracle::GetStoreMode(
Handle<JSFunction> TypeFeedbackOracle::GetCallTarget(int slot) {
Handle<Object> info = GetInfo(slot);
if (info->IsAllocationSite()) {
- return
Handle<JSFunction>(isolate()->global_context()->array_function());
+ return
Handle<JSFunction>(isolate()->native_context()->array_function());
} else {
return Handle<JSFunction>::cast(info);
}
@@ -164,7 +164,7 @@ Handle<JSFunction>
TypeFeedbackOracle::GetCallTarget(int slot) {
Handle<JSFunction> TypeFeedbackOracle::GetCallNewTarget(int slot) {
Handle<Object> info = GetInfo(slot);
if (info->IsAllocationSite()) {
- return
Handle<JSFunction>(isolate()->global_context()->array_function());
+ return
Handle<JSFunction>(isolate()->native_context()->array_function());
} else {
return Handle<JSFunction>::cast(info);
}
Index: test/mjsunit/regress/regress-crbug-347528.js
diff --git a/test/mjsunit/function-arguments-duplicate.js
b/test/mjsunit/regress/regress-crbug-347528.js
similarity index 89%
copy from test/mjsunit/function-arguments-duplicate.js
copy to test/mjsunit/regress/regress-crbug-347528.js
index
80f03a106b30a7e2f984a83b9d54b2edd8fb840a..e4e8efbc9c00f5e114b30d8973cdd9bf634b5802
100644
--- a/test/mjsunit/function-arguments-duplicate.js
+++ b/test/mjsunit/regress/regress-crbug-347528.js
@@ -25,12 +25,12 @@
// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
-// Execises ArgumentsAccessStub::GenerateNewNonStrictSlow.
+// Flags: --allow-natives-syntax --harmony
-function f(a, a) {
- assertEquals(2, a);
- assertEquals(1, arguments[0]);
- assertEquals(2, arguments[1]);
-}
-
-f(1, 2);
+"use strict";
+let unused_var = 1;
+function __f_12() { new Array(); }
+__f_12();
+__f_12();
+%OptimizeFunctionOnNextCall(__f_12);
+__f_12();
--
--
v8-dev mailing list
[email protected]
http://groups.google.com/group/v8-dev
---
You received this message because you are subscribed to the Google Groups "v8-dev" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
For more options, visit https://groups.google.com/groups/opt_out.
