Revision: 20527
Author: mvstan...@chromium.org
Date: Mon Apr 7 07:52:24 2014 UTC
Log: Fix for v8:3255 Grow KeyedStoreIC doesn't respect String value
wrappers
BUG=v8:3255
LOG=N
R=mstarzin...@chromium.org
Review URL: https://codereview.chromium.org/226053002
http://code.google.com/p/v8/source/detail?r=20527
Added:
/branches/bleeding_edge/test/mjsunit/regress/regress-3255.js
Modified:
/branches/bleeding_edge/src/ic.cc
=======================================
--- /dev/null
+++ /branches/bleeding_edge/test/mjsunit/regress/regress-3255.js Mon Apr 7
07:52:24 2014 UTC
@@ -0,0 +1,19 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --enable-slow-asserts
+
+var arr = [];
+var str = new String('x');
+
+function f(a,b) {
+ a[b] = 1;
+}
+
+f(arr, 0);
+f(str, 0);
+f(str, 0);
+
+// This is just to trigger elements validation, object already broken.
+%SetProperty(str, 1, 'y', 0);
=======================================
--- /branches/bleeding_edge/src/ic.cc Fri Apr 4 16:18:59 2014 UTC
+++ /branches/bleeding_edge/src/ic.cc Mon Apr 7 07:52:24 2014 UTC
@@ -1690,6 +1690,7 @@
if (maybe_object->IsFailure()) return maybe_object;
} else {
bool use_ic = FLAG_use_ic &&
+ !object->IsStringWrapper() &&
!object->IsAccessCheckNeeded() &&
!object->IsJSGlobalProxy() &&
!(object->IsJSObject() &&
--
--
v8-dev mailing list
v8-dev@googlegroups.com
http://groups.google.com/group/v8-dev
---
You received this message because you are subscribed to the Google Groups "v8-dev" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to v8-dev+unsubscr...@googlegroups.com.
For more options, visit https://groups.google.com/d/optout.
