From: verwaest@chromium.org <verwaest@chromium.org@ce2b1a6d-e550-0410-aec6-3dcde31c8c00>
Date: Thu, 23 May 2013 11:30:24 +0000 (+0000)
Subject: Don't use fast literal if the boilerplate map is still deprecated.
X-Git-Tag: upstream/4.7.83~14153
X-Git-Url: http://review.tizen.org/git/?a=commitdiff_plain;h=af4516847a290167c5135109db2a94461505f115;p=platform%2Fupstream%2Fv8.git

Don't use fast literal if the boilerplate map is still deprecated.

R=mvstanton@chromium.org

Review URL: https://chromiumcodereview.appspot.com/15660005

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@14774 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
---

diff --git a/src/hydrogen.cc b/src/hydrogen.cc
index 0c50b6c..305dc98 100644
--- a/src/hydrogen.cc
+++ b/src/hydrogen.cc
@@ -6692,6 +6692,12 @@ static bool IsFastLiteral(Handle<JSObject> boilerplate,
                           int* max_properties,
                           int* data_size,
                           int* pointer_size) {
+  if (boilerplate->map()->is_deprecated()) {
+    Handle<Object> result =
+        JSObject::TryMigrateInstance(boilerplate);
+    if (result->IsSmi()) return false;
+  }
+
   ASSERT(max_depth >= 0 && *max_properties >= 0);
   if (max_depth == 0) return false;
 
diff --git a/src/objects-inl.h b/src/objects-inl.h
index 3eab06c..3dd3fd6 100644
--- a/src/objects-inl.h
+++ b/src/objects-inl.h
@@ -1542,6 +1542,13 @@ MaybeObject* JSObject::MigrateInstance() {
 }
 
 
+MaybeObject* JSObject::TryMigrateInstance() {
+  Map* new_map = map()->CurrentMapForDeprecated();
+  if (new_map == NULL) return Smi::FromInt(0);
+  return MigrateToMap(new_map);
+}
+
+
 Handle<String> JSObject::ExpectedTransitionKey(Handle<Map> map) {
   AssertNoAllocation no_gc;
   if (!map->HasTransitionArray()) return Handle<String>::null();
diff --git a/src/objects.cc b/src/objects.cc
index 2562114..40b8dfb 100644
--- a/src/objects.cc
+++ b/src/objects.cc
@@ -3644,6 +3644,19 @@ void JSObject::MigrateInstance(Handle<JSObject> object) {
 }
 
 
+Handle<Object> JSObject::TryMigrateInstance(Handle<JSObject> object) {
+  if (FLAG_trace_migration) {
+    PrintF("migrating instance (no new maps) %p (%p)\n",
+           static_cast<void*>(*object),
+           static_cast<void*>(object->map()));
+  }
+  CALL_HEAP_FUNCTION(
+      object->GetIsolate(),
+      object->MigrateInstance(),
+      Object);
+}
+
+
 Handle<Map> Map::GeneralizeRepresentation(Handle<Map> map,
                                           int modify_index,
                                           Representation representation) {
diff --git a/src/objects.h b/src/objects.h
index 269590a..34d0533 100644
--- a/src/objects.h
+++ b/src/objects.h
@@ -1843,6 +1843,9 @@ class JSObject: public JSReceiver {
   static void MigrateInstance(Handle<JSObject> instance);
   inline MUST_USE_RESULT MaybeObject* MigrateInstance();
 
+  static Handle<Object> TryMigrateInstance(Handle<JSObject> instance);
+  inline MUST_USE_RESULT MaybeObject* TryMigrateInstance();
+
   // Can cause GC.
   MUST_USE_RESULT MaybeObject* SetLocalPropertyIgnoreAttributes(
       Name* key,