Reviewers: Michael Starzinger,
Description:
Merged r19676 into 3.24 branch.
Fix materialization of captured objects in adapted arguments.
BUG=348512
LOG=N
[email protected]
Please review this at https://codereview.chromium.org/194553002/
SVN Base: https://v8.googlecode.com/svn/branches/3.24
Affected files (+12, -12 lines):
M src/deoptimizer.cc
M src/version.cc
A + test/mjsunit/regress/regress-348512.js
Index: src/deoptimizer.cc
diff --git a/src/deoptimizer.cc b/src/deoptimizer.cc
index
85e20d977a700467d9abd95939281e6b349f71ea..18be014c142e364af3f357506148c2f267eaa6b6
100644
--- a/src/deoptimizer.cc
+++ b/src/deoptimizer.cc
@@ -1750,7 +1750,11 @@ Handle<Object>
Deoptimizer::MaterializeNextHeapObject() {
Handle<JSObject> arguments = Handle<JSObject>::cast(
Accessors::FunctionGetArguments(function));
materialized_objects_->Add(arguments);
- materialization_value_index_ += length;
+ // To keep consistent object counters, we still materialize the
+ // nested values (but we throw them away).
+ for (int i = 0; i < length; ++i) {
+ MaterializeNextValue();
+ }
} else if (desc.is_arguments()) {
// Construct an arguments object and copy the parameters to a newly
// allocated arguments object backing store.
Index: src/version.cc
diff --git a/src/version.cc b/src/version.cc
index
ed4d22633cd1bff3b24e99134d6b5b4adc1fef51..e964094a35ff11dd6374440b1fd274732c2f9e2e
100644
--- a/src/version.cc
+++ b/src/version.cc
@@ -35,7 +35,7 @@
#define MAJOR_VERSION 3
#define MINOR_VERSION 24
#define BUILD_NUMBER 35
-#define PATCH_LEVEL 13
+#define PATCH_LEVEL 14
// Use 1 for candidates and 0 otherwise.
// (Boolean macro values are not supported by all preprocessors.)
#define IS_CANDIDATE_VERSION 0
Index: test/mjsunit/regress/regress-348512.js
diff --git a/test/mjsunit/recursive-store-opt.js
b/test/mjsunit/regress/regress-348512.js
similarity index 92%
copy from test/mjsunit/recursive-store-opt.js
copy to test/mjsunit/regress/regress-348512.js
index
fb2649248dbabc642f864f671d0ce2273ad44bd7..7d896664c249c1974ad468292c14284fd2e99413
100644
--- a/test/mjsunit/recursive-store-opt.js
+++ b/test/mjsunit/regress/regress-348512.js
@@ -27,15 +27,11 @@
// Flags: --allow-natives-syntax
-function g() {
- this.x = this;
-}
+function h(y) { assertEquals(42, y.u); }
+function g() { h.apply(0, arguments); }
+function f(x) { g({ u : x }); }
-function f() {
- return new g();
-}
-
-f();
-f();
+f(42);
+f(42);
%OptimizeFunctionOnNextCall(f);
-f();
+f(42);
--
--
v8-dev mailing list
[email protected]
http://groups.google.com/group/v8-dev
---
You received this message because you are subscribed to the Google Groups "v8-dev" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
For more options, visit https://groups.google.com/d/optout.
