From 2f32fab4d03ef9c5884c80f355f4b27f28258e9e Mon Sep 17 00:00:00 2001 From: "erik.corry@gmail.com" Date: Thu, 8 Sep 2011 06:06:13 +0000 Subject: [PATCH] JSArray can go slow case during String.split. Guard against that eventuality. Review URL: http://codereview.chromium.org/7840031 git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@9183 ce2b1a6d-e550-0410-aec6-3dcde31c8c00 --- src/objects-debug.cc | 6 +++--- src/runtime.cc | 12 +++++++----- 2 files changed, 10 insertions(+), 8 deletions(-) diff --git a/src/objects-debug.cc b/src/objects-debug.cc index 4da360b..a3dc193 100644 --- a/src/objects-debug.cc +++ b/src/objects-debug.cc @@ -257,9 +257,9 @@ void JSObject::JSObjectVerify() { (map()->inobject_properties() + properties()->length() - map()->NextFreePropertyIndex())); } - ASSERT(map()->has_fast_elements() == - (elements()->map() == GetHeap()->fixed_array_map() || - elements()->map() == GetHeap()->fixed_cow_array_map())); + ASSERT_EQ(map()->has_fast_elements(), + (elements()->map() == GetHeap()->fixed_array_map() || + elements()->map() == GetHeap()->fixed_cow_array_map())); ASSERT(map()->has_fast_elements() == HasFastElements()); } diff --git a/src/runtime.cc b/src/runtime.cc index 4e747d5..a28cb59 100644 --- a/src/runtime.cc +++ b/src/runtime.cc @@ -6195,11 +6195,13 @@ RUNTIME_FUNCTION(MaybeObject*, Runtime_StringSplit) { } if (limit == 0xffffffffu) { - StringSplitCache::Enter(isolate->heap(), - isolate->heap()->string_split_cache(), - *subject, - *pattern, - *elements); + if (result->HasFastElements()) { + StringSplitCache::Enter(isolate->heap(), + isolate->heap()->string_split_cache(), + *subject, + *pattern, + *elements); + } } return *result; -- 2.7.4