Initialize internal arrays with the correct map.

BUG=v8:1878
TEST=regress-1878.js

Review URL: https://chromiumcodereview.appspot.com/9402009

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10712 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

diff --git a/src/builtins.cc b/src/builtins.cc
index 0d5b2b26f3f39a8917d33041261592897b504beb..7290a2cf1cef2611efc35a6943fc588bb9f70dc3 100644 (file)
--- a/src/builtins.cc
+++ b/src/builtins.cc
@@ -206,8 +206,7 @@ static MaybeObject* ArrayCodeGenericCommon(Arguments* args,
     }
   } else {
     // Allocate the JS Array
-    MaybeObject* maybe_obj =
-        heap->AllocateEmptyJSArray(FAST_SMI_ONLY_ELEMENTS);
+    MaybeObject* maybe_obj = heap->AllocateJSObject(constructor);
     if (!maybe_obj->To(&array)) return maybe_obj;
   }
 

diff --git a/test/mjsunit/regress/regress-1878.js b/test/mjsunit/regress/regress-1878.js
index 1b3c63aeb1ec56d1d3d223eb5b821fcb5d221065..a1648b1217f91c4c4fa81f88485d5e6462dbb9ba 100644 (file)
--- a/test/mjsunit/regress/regress-1878.js
+++ b/test/mjsunit/regress/regress-1878.js
@@ -1,4 +1,4 @@
-// Copyright 2009 the V8 project authors. All rights reserved.
+// Copyright 2012 the V8 project authors. All rights reserved.
 // Redistribution and use in source and binary forms, with or without
 // modification, are permitted provided that the following conditions are
 // met:
@@ -30,5 +30,15 @@
 // Flags: --allow-natives-syntax --expose_natives_as=natives
 
 var a = Array();
-var ai = natives.InternalArray();
-assertFalse(%HaveSameMap(ai, a));
+
+for (var i = 0; i < 1000; i++) {
+  var ai = natives.InternalArray(10000);
+  assertFalse(%HaveSameMap(ai, a));
+  assertTrue(%HasFastElements(ai));
+}
+
+for (var i = 0; i < 1000; i++) {
+  var ai = new natives.InternalArray(10000);
+  assertFalse(%HaveSameMap(ai, a));
+  assertTrue(%HasFastElements(ai));
+}