From 885a88166d3868054958a616b844d4b6342c9bb9 Mon Sep 17 00:00:00 2001 From: machenbach Date: Thu, 26 Feb 2015 13:03:02 -0800 Subject: [PATCH] Revert of Invalidate the global property cell when converting from data to accessor. (patchset #1 id:1 of https://codereview.chromium.org/961003002/) Reason for revert: Breaks gc stress, e.g.: http://build.chromium.org/p/client.v8/builders/V8%20GC%20Stress%20-%201/builds/2322 Original issue's description: > Invalidate the global property cell when converting from data to accessor. > > BUG= > TBR=jkummerow@chromium.org, > > Committed: https://crrev.com/6a12dc240b1faffa500ff269077d832ecc74239d > Cr-Commit-Position: refs/heads/master@{#26896} TBR=jkummerow@chromium.org,verwaest@chromium.org NOPRESUBMIT=true NOTREECHECKS=true NOTRY=true BUG= Review URL: https://codereview.chromium.org/958113004 Cr-Commit-Position: refs/heads/master@{#26899} --- src/ic/handler-compiler.h | 2 +- src/objects.cc | 17 +++++++---------- .../regress/convert-global-data-to-accessor.js | 15 --------------- 3 files changed, 8 insertions(+), 26 deletions(-) delete mode 100644 test/mjsunit/regress/convert-global-data-to-accessor.js diff --git a/src/ic/handler-compiler.h b/src/ic/handler-compiler.h index eb42ef6a1..bd3f788e3 100644 --- a/src/ic/handler-compiler.h +++ b/src/ic/handler-compiler.h @@ -95,7 +95,7 @@ class PropertyHandlerCompiler : public PropertyAccessCompiler { Register CheckPrototypes(Register object_reg, Register holder_reg, Register scratch1, Register scratch2, Handle name, Label* miss, - PrototypeCheckType check); + PrototypeCheckType check = CHECK_ALL_MAPS); Handle GetCode(Code::Kind kind, Code::StubType type, Handle name); void set_holder(Handle holder) { holder_ = holder; } diff --git a/src/objects.cc b/src/objects.cc index 60e55295a..6fd95030c 100644 --- a/src/objects.cc +++ b/src/objects.cc @@ -565,15 +565,7 @@ void JSObject::SetNormalizedProperty(Handle object, if (object->IsGlobalObject()) { Handle cell( PropertyCell::cast(property_dictionary->ValueAt(entry))); - if (details.type() != property_dictionary->DetailsAt(entry).type()) { - Isolate* isolate = object->GetIsolate(); - Handle hole = isolate->factory()->the_hole_value(); - PropertyCell::SetValueInferType(cell, hole); - cell = isolate->factory()->NewPropertyCell(value); - property_dictionary->SetEntry(entry, name, cell, details); - } else { - PropertyCell::SetValueInferType(cell, value); - } + PropertyCell::SetValueInferType(cell, value); // Please note we have to update the property details. property_dictionary->DetailsAtPut(entry, details); } else { @@ -7440,7 +7432,12 @@ Handle Map::TransitionToAccessorProperty(Handle map, Isolate* isolate = name->GetIsolate(); // Dictionary maps can always have additional data properties. - if (map->is_dictionary_map()) return map; + if (map->is_dictionary_map()) { + // For global objects, property cells are inlined. We need to change the + // map. + if (map->IsGlobalObjectMap()) return Copy(map, "GlobalAccessor"); + return map; + } // Migrate to the newest map before transitioning to the new property. map = Update(map); diff --git a/test/mjsunit/regress/convert-global-data-to-accessor.js b/test/mjsunit/regress/convert-global-data-to-accessor.js deleted file mode 100644 index 976470935..000000000 --- a/test/mjsunit/regress/convert-global-data-to-accessor.js +++ /dev/null @@ -1,15 +0,0 @@ -// Copyright 2015 the V8 project authors. All rights reserved. -// Use of this source code is governed by a BSD-style license that can be -// found in the LICENSE file. - -function f(o) { - return o.x; -} -this.x = 100; -f(this); -f(this); -f(this); - -Object.defineProperty(this, 'x', { get: function() { return 10; }}); -assertEquals(10, this.x); -assertEquals(10, f(this)); -- 2.34.1