From f74a85f3b7daab941ca01a688c949435294f68aa Mon Sep 17 00:00:00 2001 From: "verwaest@chromium.org" Date: Tue, 21 May 2013 17:21:27 +0000 Subject: [PATCH] Don't track representations in context extensions. This also enables verification of representations. BUG= R=jkummerow@chromium.org Review URL: https://chromiumcodereview.appspot.com/15411003 git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@14735 ce2b1a6d-e550-0410-aec6-3dcde31c8c00 --- src/objects-debug.cc | 11 +++++++++++ src/objects.cc | 7 +++++-- 2 files changed, 16 insertions(+), 2 deletions(-) diff --git a/src/objects-debug.cc b/src/objects-debug.cc index ecbf9d6..891f0d2 100644 --- a/src/objects-debug.cc +++ b/src/objects-debug.cc @@ -306,6 +306,17 @@ void JSObject::JSObjectVerify() { CHECK_EQ(map()->unused_property_fields(), (map()->inobject_properties() + properties()->length() - map()->NextFreePropertyIndex())); + DescriptorArray* descriptors = map()->instance_descriptors(); + for (int i = 0; i < map()->NumberOfOwnDescriptors(); i++) { + if (descriptors->GetDetails(i).type() == FIELD) { + Representation r = descriptors->GetDetails(i).representation(); + int field = descriptors->GetFieldIndex(i); + Object* value = RawFastPropertyAt(field); + if (r.IsSmi()) ASSERT(value->IsSmi()); + if (r.IsDouble()) ASSERT(value->IsHeapNumber()); + if (r.IsHeapObject()) ASSERT(value->IsHeapObject()); + } + } } CHECK_EQ((map()->has_fast_smi_or_object_elements() || (elements() == GetHeap()->empty_fixed_array())), diff --git a/src/objects.cc b/src/objects.cc index 1e586e8..6513482 100644 --- a/src/objects.cc +++ b/src/objects.cc @@ -1801,7 +1801,9 @@ MaybeObject* JSObject::AddFastProperty(Name* name, int index = map()->NextFreePropertyIndex(); // Allocate new instance descriptors with (name, index) added - Representation representation = value->OptimalRepresentation(); + Representation representation = IsJSContextExtensionObject() + ? Representation::Tagged() : value->OptimalRepresentation(); + FieldDescriptor new_field(name, index, attributes, representation); ASSERT(index < map()->inobject_properties() || @@ -2105,7 +2107,8 @@ MaybeObject* JSObject::ConvertDescriptorToField(Name* name, return ReplaceSlowProperty(name, new_value, attributes); } - Representation representation = new_value->OptimalRepresentation(); + Representation representation = IsJSContextExtensionObject() + ? Representation::Tagged() : new_value->OptimalRepresentation(); int index = map()->NextFreePropertyIndex(); FieldDescriptor new_field(name, index, attributes, representation); -- 2.7.4