From e7e93cd433d96f26cecf13bfe41ecf20580714ff Mon Sep 17 00:00:00 2001 From: "jkummerow@chromium.org" Date: Tue, 25 Feb 2014 15:09:47 +0000 Subject: [PATCH] Mark HCompareMap as having Tagged representation BUG=chromium:346636 LOG=y R=svenpanne@chromium.org Review URL: https://codereview.chromium.org/176923013 git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@19545 ce2b1a6d-e550-0410-aec6-3dcde31c8c00 --- src/hydrogen-instructions.h | 1 + test/mjsunit/regress/regress-crbug-346636.js | 31 ++++++++++++++++++++++++++++ 2 files changed, 32 insertions(+) create mode 100644 test/mjsunit/regress/regress-crbug-346636.js diff --git a/src/hydrogen-instructions.h b/src/hydrogen-instructions.h index 0a92a9f..baf64fc 100644 --- a/src/hydrogen-instructions.h +++ b/src/hydrogen-instructions.h @@ -1617,6 +1617,7 @@ class HCompareMap V8_FINAL : public HUnaryControlInstruction { map->AddDependentCompilationInfo( DependentCode::kPrototypeCheckGroup, info); } + set_representation(Representation::Tagged()); } int known_successor_index_; diff --git a/test/mjsunit/regress/regress-crbug-346636.js b/test/mjsunit/regress/regress-crbug-346636.js new file mode 100644 index 0000000..247f8be --- /dev/null +++ b/test/mjsunit/regress/regress-crbug-346636.js @@ -0,0 +1,31 @@ +// Copyright 2014 the V8 project authors. All rights reserved. +// Use of this source code is governed by a BSD-style license that can be +// found in the LICENSE file. + +// Flags: --allow-natives-syntax + +function assertSame(expected, found) { + if (found === expected) { + if (expected !== 0 || (1 / expected) == (1 / found)) return; + } + return; +}; + +function foo(x) { + return x.bar; +} + +function getter1() { + assertSame(this, this); +} +var o1 = Object.defineProperty({}, "bar", { get: getter1 }); +foo(o1); +foo(o1); + +function getter2() { + assertSame(this, this); +} +var o2 = Object.defineProperty({}, "bar", { get: getter2 }); +foo(o2); +%OptimizeFunctionOnNextCall(foo); +foo(o2); -- 2.7.4