When following an accessor transition for an already existing accessor, don't load...

BUG=137689
TEST=test/mjsunit/regress/regress-crbug-137689.js

Review URL: https://chromiumcodereview.appspot.com/10808005

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12115 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

diff --git a/src/objects.cc b/src/objects.cc
index 4f99d59..2ce1451 100644 (file)
--- a/src/objects.cc
+++ b/src/objects.cc
@@ -4424,19 +4424,19 @@ MaybeObject* JSObject::DefineAccessor(String* name,
 
 static MaybeObject* TryAccessorTransition(JSObject* self,
                                           Map* transitioned_map,
-                                          String* name,
+                                          int target_descriptor,
                                           AccessorComponent component,
                                           Object* accessor,
                                           PropertyAttributes attributes) {
   DescriptorArray* descs = transitioned_map->instance_descriptors();
-  int number = descs->LastAdded();
-  PropertyDetails details = descs->GetDetails(number);
+  PropertyDetails details = descs->GetDetails(target_descriptor);
 
   // If the transition target was not callbacks, fall back to the slow case.
   if (details.type() != CALLBACKS) return self->GetHeap()->null_value();
+  Object* descriptor = descs->GetCallbacksObject(target_descriptor);
+  if (!descriptor->IsAccessorPair()) return self->GetHeap()->null_value();
 
-  Object* target_accessor =
-      AccessorPair::cast(descs->GetCallbacksObject(number))->get(component);
+  Object* target_accessor = AccessorPair::cast(descriptor)->get(component);
   PropertyAttributes target_attributes = details.attributes();
 
   // Reuse transition if adding same accessor with same attributes.
@@ -4473,17 +4473,34 @@ MaybeObject* JSObject::DefineFastAccessor(String* name,
       if (entry == accessor && result.GetAttributes() == attributes) {
         return this;
       }
+    } else {
+      return GetHeap()->null_value();
     }
-  }
 
-  // If not, lookup a transition.
-  map()->LookupTransition(this, name, &result);
+    int descriptor_number = result.GetDescriptorIndex();
 
-  // If there is a transition, try to follow it.
-  if (result.IsFound()) {
-    Map* target = result.GetTransitionTarget();
-    return TryAccessorTransition(
-        this, target, name, component, accessor, attributes);
+    map()->LookupTransition(this, name, &result);
+
+    if (result.IsFound()) {
+      Map* target = result.GetTransitionTarget();
+      ASSERT(target->instance_descriptors()->number_of_descriptors() ==
+             map()->instance_descriptors()->number_of_descriptors());
+      ASSERT(target->instance_descriptors()->GetKey(descriptor_number) == name);
+      return TryAccessorTransition(
+          this, target, descriptor_number, component, accessor, attributes);
+    }
+  } else {
+    // If not, lookup a transition.
+    map()->LookupTransition(this, name, &result);
+
+    // If there is a transition, try to follow it.
+    if (result.IsFound()) {
+      Map* target = result.GetTransitionTarget();
+      int descriptor_number = target->instance_descriptors()->LastAdded();
+      ASSERT(target->instance_descriptors()->GetKey(descriptor_number) == name);
+      return TryAccessorTransition(
+          this, target, descriptor_number, component, accessor, attributes);
+    }
   }
 
   // If there is no transition yet, add a transition to the a new accessor pair

diff --git a/src/property.h b/src/property.h
index a947540..78f30ef 100644 (file)
--- a/src/property.h
+++ b/src/property.h
@@ -328,6 +328,11 @@ class LookupResult BASE_EMBEDDED {
     return number_;
   }
 
+  int GetDescriptorIndex() {
+    ASSERT(lookup_type_ == DESCRIPTOR_TYPE);
+    return number_;
+  }
+
   int GetFieldIndex() {
     ASSERT(lookup_type_ == DESCRIPTOR_TYPE);
     ASSERT(IsField());

diff --git a/test/mjsunit/regress/regress-crbug-137689.js b/test/mjsunit/regress/regress-crbug-137689.js
new file mode 100644 (file)
index 0000000..ef79d24
--- /dev/null
+++ b/test/mjsunit/regress/regress-crbug-137689.js
@@ -0,0 +1,47 @@
+// Copyright 2012 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+//     * Redistributions of source code must retain the above copyright
+//       notice, this list of conditions and the following disclaimer.
+//     * Redistributions in binary form must reproduce the above
+//       copyright notice, this list of conditions and the following
+//       disclaimer in the documentation and/or other materials provided
+//       with the distribution.
+//     * Neither the name of Google Inc. nor the names of its
+//       contributors may be used to endorse or promote products derived
+//       from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --allow-natives-syntax
+
+function getter() { return 10; }
+function setter(v) { }
+function getter2() { return 20; }
+
+var o = {};
+var o2 = {};
+
+Object.defineProperty(o, "foo", { get: getter, configurable: true });
+Object.defineProperty(o2, "foo", { get: getter, configurable: true });
+assertTrue(%HaveSameMap(o, o2));
+
+Object.defineProperty(o, "bar", { get: getter2 });
+Object.defineProperty(o2, "bar", { get: getter2 });
+assertTrue(%HaveSameMap(o, o2));
+
+Object.defineProperty(o, "foo", { set: setter, configurable: true });
+Object.defineProperty(o2, "foo", { set: setter, configurable: true });
+assertTrue(%HaveSameMap(o, o2));