JSArray can go slow case during String.split. Guard against

that eventuality.
Review URL: http://codereview.chromium.org/7840031

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@9183 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

diff --git a/src/objects-debug.cc b/src/objects-debug.cc
index 4da360b81e3658e438fcebda253354ed9e500b2c..a3dc19357f13d24a7f0e703a1582938b827f116a 100644 (file)
--- a/src/objects-debug.cc
+++ b/src/objects-debug.cc
@@ -257,9 +257,9 @@ void JSObject::JSObjectVerify() {
              (map()->inobject_properties() + properties()->length() -
               map()->NextFreePropertyIndex()));
   }
-  ASSERT(map()->has_fast_elements() ==
-         (elements()->map() == GetHeap()->fixed_array_map() ||
-          elements()->map() == GetHeap()->fixed_cow_array_map()));
+  ASSERT_EQ(map()->has_fast_elements(),
+            (elements()->map() == GetHeap()->fixed_array_map() ||
+             elements()->map() == GetHeap()->fixed_cow_array_map()));
   ASSERT(map()->has_fast_elements() == HasFastElements());
 }
 

diff --git a/src/runtime.cc b/src/runtime.cc
index 4e747d53e2b63b4d35973b0cf83ee8a85ae18cb0..a28cb5996fb4ae0bc1241cd1ad28503c76600dbc 100644 (file)
--- a/src/runtime.cc
+++ b/src/runtime.cc
@@ -6195,11 +6195,13 @@ RUNTIME_FUNCTION(MaybeObject*, Runtime_StringSplit) {
   }
 
   if (limit == 0xffffffffu) {
-    StringSplitCache::Enter(isolate->heap(),
-                            isolate->heap()->string_split_cache(),
-                            *subject,
-                            *pattern,
-                            *elements);
+    if (result->HasFastElements()) {
+      StringSplitCache::Enter(isolate->heap(),
+                              isolate->heap()->string_split_cache(),
+                              *subject,
+                              *pattern,
+                              *elements);
+    }
   }
 
   return *result;