From: danno@chromium.org Date: Tue, 27 Sep 2011 11:16:39 +0000 (+0000) Subject: Smi element fixes in Builtins. X-Git-Tag: upstream/4.7.83~18352 X-Git-Url: http://review.tizen.org/git/?a=commitdiff_plain;h=ebc3010ca3857b98bcb1e7d7648f8b513cccddd6;p=platform%2Fupstream%2Fv8.git Smi element fixes in Builtins. R=jkummerow@chromium.org BUG=none TEST=dromaeo-object-array-array-deconstruction-pop doesn't regress Review URL: http://codereview.chromium.org/8054007 git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@9448 ce2b1a6d-e550-0410-aec6-3dcde31c8c00 --- diff --git a/src/builtins.cc b/src/builtins.cc index 23f7bdb1d..5104f6d0d 100644 --- a/src/builtins.cc +++ b/src/builtins.cc @@ -660,7 +660,7 @@ BUILTIN(ArraySlice) { int len = -1; if (receiver->IsJSArray()) { JSArray* array = JSArray::cast(receiver); - if (!array->HasFastElements() || + if (!array->HasFastTypeElements() || !IsJSArrayFastElementMovingAllowed(heap, array)) { return CallJsBuiltin(isolate, "ArraySlice", args); } @@ -676,7 +676,7 @@ BUILTIN(ArraySlice) { bool is_arguments_object_with_fast_elements = receiver->IsJSObject() && JSObject::cast(receiver)->map() == arguments_map - && JSObject::cast(receiver)->HasFastElements(); + && JSObject::cast(receiver)->HasFastTypeElements(); if (!is_arguments_object_with_fast_elements) { return CallJsBuiltin(isolate, "ArraySlice", args); } @@ -963,7 +963,7 @@ BUILTIN(ArrayConcat) { int result_len = 0; for (int i = 0; i < n_arguments; i++) { Object* arg = args[i]; - if (!arg->IsJSArray() || !JSArray::cast(arg)->HasFastElements() + if (!arg->IsJSArray() || !JSArray::cast(arg)->HasFastTypeElements() || JSArray::cast(arg)->GetPrototype() != array_proto) { return CallJsBuiltin(isolate, "ArrayConcat", args); }