From c24ebcd387331a0efa592a20d1d74bf5a389e725 Mon Sep 17 00:00:00 2001 From: "arv@chromium.org" Date: Fri, 7 Nov 2014 18:49:24 +0000 Subject: [PATCH] Revert "Avoid some unnecessary fast-properties map creations." This reverts commit e1f23eab4255d63344011dfb885b8e8962cb60e2. Broke cctest/test-heap/ReleaseOverReservedPages on a bunch of builders http://build.chromium.org/p/client.v8/builders/V8%20Linux%20-%20debug/builds/928/steps/Check/logs/ReleaseOverReservedPa.. BUG=None LOG=N TBR=jkummerow@chromium.org Review URL: https://codereview.chromium.org/709123002 Cr-Commit-Position: refs/heads/master@{#25224} git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@25224 ce2b1a6d-e550-0410-aec6-3dcde31c8c00 --- src/objects.cc | 8 ++------ src/runtime/runtime-object.cc | 2 ++ test/mjsunit/object-freeze.js | 2 +- test/mjsunit/regress/regress-crbug-137689.js | 3 ++- 4 files changed, 7 insertions(+), 8 deletions(-) diff --git a/src/objects.cc b/src/objects.cc index 8303489..63b7312 100644 --- a/src/objects.cc +++ b/src/objects.cc @@ -9505,17 +9505,13 @@ void JSObject::OptimizeAsPrototype(Handle object, JSObject::NormalizeProperties(object, KEEP_INOBJECT_PROPERTIES, 0, "NormalizeAsPrototype"); } - bool has_just_copied_map = false; if (!object->HasFastProperties()) { JSObject::MigrateSlowToFast(object, 0, "OptimizeAsPrototype"); - has_just_copied_map = true; } if (mode == FAST_PROTOTYPE && object->HasFastProperties() && !object->map()->is_prototype_map()) { - if (!has_just_copied_map) { - Handle new_map = Map::Copy(handle(object->map()), "CopyAsPrototype"); - JSObject::MigrateToMap(object, new_map); - } + Handle new_map = Map::Copy(handle(object->map()), "CopyAsPrototype"); + JSObject::MigrateToMap(object, new_map); object->map()->set_is_prototype_map(true); } } diff --git a/src/runtime/runtime-object.cc b/src/runtime/runtime-object.cc index 524c884..b2a736d 100644 --- a/src/runtime/runtime-object.cc +++ b/src/runtime/runtime-object.cc @@ -1455,8 +1455,10 @@ RUNTIME_FUNCTION(Runtime_DefineAccessorPropertyUnchecked) { RUNTIME_ASSERT((unchecked & ~(READ_ONLY | DONT_ENUM | DONT_DELETE)) == 0); PropertyAttributes attr = static_cast(unchecked); + bool fast = obj->HasFastProperties(); RETURN_FAILURE_ON_EXCEPTION( isolate, JSObject::DefineAccessor(obj, name, getter, setter, attr)); + if (fast) JSObject::MigrateSlowToFast(obj, 0, "RuntimeDefineAccessor"); return isolate->heap()->undefined_value(); } diff --git a/test/mjsunit/object-freeze.js b/test/mjsunit/object-freeze.js index a482513..4144936 100644 --- a/test/mjsunit/object-freeze.js +++ b/test/mjsunit/object-freeze.js @@ -303,7 +303,7 @@ assertTrue(Object.isFrozen(Object.freeze(function(){"use strict";}))); // Also test a simpler case obj = {}; -Object.defineProperty(obj, 'accessor2', { +Object.defineProperty(obj, 'accessor', { get: function() { return 42 }, set: function() { accessorDidRun = true }, configurable: true, diff --git a/test/mjsunit/regress/regress-crbug-137689.js b/test/mjsunit/regress/regress-crbug-137689.js index ef79d24..0ff0c4e 100644 --- a/test/mjsunit/regress/regress-crbug-137689.js +++ b/test/mjsunit/regress/regress-crbug-137689.js @@ -44,4 +44,5 @@ assertTrue(%HaveSameMap(o, o2)); Object.defineProperty(o, "foo", { set: setter, configurable: true }); Object.defineProperty(o2, "foo", { set: setter, configurable: true }); -assertTrue(%HaveSameMap(o, o2)); +// TODO(ishell): this should eventually become assertTrue(). +assertFalse(%HaveSameMap(o, o2)); -- 2.7.4