From 90c2448be6853b937adb9a5e912949229f3598c9 Mon Sep 17 00:00:00 2001 From: "mstarzinger@chromium.org" Date: Thu, 14 Jun 2012 13:54:23 +0000 Subject: [PATCH] Fix assertion for map code cache of shared maps. R=danno@chromium.org TEST=mjsunit/compare-known-objects-slow Review URL: https://chromiumcodereview.appspot.com/10548046 git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@11815 ce2b1a6d-e550-0410-aec6-3dcde31c8c00 --- src/objects.cc | 3 +- test/mjsunit/compare-known-objects-slow.js | 69 ++++++++++++++++++++++++++++++ 2 files changed, 71 insertions(+), 1 deletion(-) create mode 100644 test/mjsunit/compare-known-objects-slow.js diff --git a/src/objects.cc b/src/objects.cc index 6314955..329a0c5 100644 --- a/src/objects.cc +++ b/src/objects.cc @@ -8279,7 +8279,8 @@ void Code::ClearTypeFeedbackCells(Heap* heap) { bool Code::allowed_in_shared_map_code_cache() { - return is_keyed_load_stub() || is_keyed_store_stub(); + return is_keyed_load_stub() || is_keyed_store_stub() || + (is_compare_ic_stub() && compare_state() == CompareIC::KNOWN_OBJECTS); } diff --git a/test/mjsunit/compare-known-objects-slow.js b/test/mjsunit/compare-known-objects-slow.js new file mode 100644 index 0000000..afa198f --- /dev/null +++ b/test/mjsunit/compare-known-objects-slow.js @@ -0,0 +1,69 @@ +// Copyright 2012 the V8 project authors. All rights reserved. +// Redistribution and use in source and binary forms, with or without +// modification, are permitted provided that the following conditions are +// met: +// +// * Redistributions of source code must retain the above copyright +// notice, this list of conditions and the following disclaimer. +// * Redistributions in binary form must reproduce the above +// copyright notice, this list of conditions and the following +// disclaimer in the documentation and/or other materials provided +// with the distribution. +// * Neither the name of Google Inc. nor the names of its +// contributors may be used to endorse or promote products derived +// from this software without specific prior written permission. +// +// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS +// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT +// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR +// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT +// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, +// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT +// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, +// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY +// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT +// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE +// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. + +// Flags: --allow-natives-syntax + +// Test CompareIC stubs for normal and strict equality comparison of known +// objects in slow mode. These objects share the same map even though they +// might have completely different properties. + +function eq(a, b) { + return a == b; +} + +function eq_strict(a, b) { + return a === b; +} + +function test(a, b) { + // Check CompareIC for equality of known objects. + assertTrue(eq(a, a)); + assertTrue(eq(b, b)); + assertFalse(eq(a, b)); + // Check CompareIC for strict equality of known objects. + assertTrue(eq_strict(a, a)); + assertTrue(eq_strict(b, b)); + assertFalse(eq_strict(a, b)); +} + +// Prepare two objects in slow mode that have the same map. +var obj1 = %OptimizeObjectForAddingMultipleProperties({}, 1); +var obj2 = %OptimizeObjectForAddingMultipleProperties({}, 1); + +// Test original objects. +assertTrue(%HaveSameMap(obj1, obj2)); +test(obj1, obj2); + +// Test after adding property to first object. +obj1.x = 1; +assertTrue(%HaveSameMap(obj1, obj2)); +test(obj1, obj2); + +// Test after adding property to second object. +obj2.y = 2; +assertTrue(%HaveSameMap(obj1, obj2)); +test(obj1, obj2); -- 2.7.4