Reviewers: Toon Verwaest,
Description:
Avoid setting transitions in-place for cached maps when observed
[email protected]
BUG=
Please review this at https://codereview.chromium.org/246523004/
SVN Base: https://v8.googlecode.com/svn/branches/bleeding_edge
Affected files (+6, -4 lines):
M src/objects.cc
A + test/mjsunit/regress/regress-observe-map-cache.js
Index: src/objects.cc
diff --git a/src/objects.cc b/src/objects.cc
index
f28430430ff4060552b80d8c59bcd4214f4fe038..e1cdc625fb1b78e7af5521858e4019ff3c5c1f86
100644
--- a/src/objects.cc
+++ b/src/objects.cc
@@ -5816,7 +5816,7 @@ void JSObject::SetObserved(Handle<JSObject> object) {
if (transition_index != TransitionArray::kNotFound) {
new_map = handle(old_map->GetTransition(transition_index), isolate);
ASSERT(new_map->is_observed());
- } else if (old_map->CanHaveMoreTransitions()) {
+ } else if (object->HasFastProperties() &&
old_map->CanHaveMoreTransitions()) {
new_map = Map::CopyForObserved(old_map);
} else {
new_map = Map::Copy(old_map);
Index: test/mjsunit/regress/regress-observe-map-cache.js
diff --git a/test/mjsunit/regress/regress-store-global-proxy.js
b/test/mjsunit/regress/regress-observe-map-cache.js
similarity index 58%
copy from test/mjsunit/regress/regress-store-global-proxy.js
copy to test/mjsunit/regress/regress-observe-map-cache.js
index
c85531c5fd917daa67b54e87141a164b90f3729b..4c7a7e3e973d12cde43caaa64b11f6f08cef3dcc
100644
--- a/test/mjsunit/regress/regress-store-global-proxy.js
+++ b/test/mjsunit/regress/regress-observe-map-cache.js
@@ -2,11 +2,13 @@
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
-delete Object.prototype.__proto__;
+// Flags: --allow-natives-syntax --enable-slow-asserts
function f() {
- this.toString = 1;
+ var x = new Array(0);
+ x[-1] = -1;
+ Object.observe(x, function() { });
}
-f.apply({});
+f();
f();
--
--
v8-dev mailing list
[email protected]
http://groups.google.com/group/v8-dev
---
You received this message because you are subscribed to the Google Groups "v8-dev" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
For more options, visit https://groups.google.com/d/optout.
