Allocation type info advice consumed in bailout path leads to assert failure.
authormvstanton@chromium.org <mvstanton@chromium.org@ce2b1a6d-e550-0410-aec6-3dcde31c8c00>
Thu, 6 Jun 2013 09:26:30 +0000 (09:26 +0000)
committermvstanton@chromium.org <mvstanton@chromium.org@ce2b1a6d-e550-0410-aec6-3dcde31c8c00>
Thu, 6 Jun 2013 09:26:30 +0000 (09:26 +0000)
commita9a80fb4227a61c508fc456cd6f8aacddc4db4fe
tree6b4e8ed09927c54d16970854640ec0e282cb11bd
parent7a34b394a586b6cd51ab4dac2e213262fa48fdc9
Allocation type info advice consumed in bailout path leads to assert failure.

If the runtime is taken for a constructor like "new Array(100000)", where
allocation site info already led to an elements kind of DOUBLE, then the runtime
would fail to transition the array to dictionary mode. Better to recognize this
case and avoid wasting time by following the advice. Furthermore, it offers a
way to recognize that the array should be in dictionary mode (though a future
checkin will capitalize on that).

BUG=
R=danno@chromium.org

Review URL: https://codereview.chromium.org/15993012

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@14966 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
src/builtins.cc
test/mjsunit/allocation-site-info.js