Chromium Code Reviews| Index: src/heap.cc |
| diff --git a/src/heap.cc b/src/heap.cc |
| index fafcb64d370a8ba6c11f87dd4c882456ea903cec..5bb1ee49d3f27873ee40741d1f32979607e1f4f2 100644 |
| --- a/src/heap.cc |
| +++ b/src/heap.cc |
| @@ -3963,30 +3963,36 @@ void Heap::InitializeFunction(JSFunction* function, |
| MaybeObject* Heap::AllocateFunctionPrototype(JSFunction* function) { |
| - // Allocate the prototype. Make sure to use the object function |
| - // from the function's context, since the function can be from a |
| - // different context. |
| - JSFunction* object_function = |
| - function->context()->native_context()->object_function(); |
| - |
| - // Each function prototype gets a copy of the object function map. |
| - // This avoid unwanted sharing of maps between prototypes of different |
| - // constructors. |
| + // Make sure to use globals from the function's context, since the function |
| + // can be from a different context. |
| + Context* native_context = function->context()->native_context(); |
| + bool needs_constructor_property; |
| Map* new_map; |
| - ASSERT(object_function->has_initial_map()); |
| - MaybeObject* maybe_map = object_function->initial_map()->Copy(); |
| - if (!maybe_map->To(&new_map)) return maybe_map; |
| + if (function->shared()->is_generator()) { |
| + // Generator prototypes can share maps since they don't have "constructor" |
|
rossberg
2013/04/09 16:44:14
Hm, according to the class diagram they have.
|
| + // properties. |
| + new_map = native_context->generator_iterator_prototype_map(); |
| + needs_constructor_property = false; |
| + } else { |
| + // Each function prototype gets a fresh map to avoid unwanted sharing of |
| + // maps between prototypes of different constructors. |
| + JSFunction* object_function = native_context->object_function(); |
| + ASSERT(object_function->has_initial_map()); |
| + MaybeObject* maybe_map = object_function->initial_map()->Copy(); |
| + if (!maybe_map->To(&new_map)) return maybe_map; |
| + needs_constructor_property = true; |
| + } |
| Object* prototype; |
| MaybeObject* maybe_prototype = AllocateJSObjectFromMap(new_map); |
| if (!maybe_prototype->ToObject(&prototype)) return maybe_prototype; |
| - // When creating the prototype for the function we must set its |
| - // constructor to the function. |
| - MaybeObject* maybe_failure = |
| - JSObject::cast(prototype)->SetLocalPropertyIgnoreAttributes( |
| - constructor_string(), function, DONT_ENUM); |
| - if (maybe_failure->IsFailure()) return maybe_failure; |
| + if (needs_constructor_property) { |
| + MaybeObject* maybe_failure = |
| + JSObject::cast(prototype)->SetLocalPropertyIgnoreAttributes( |
| + constructor_string(), function, DONT_ENUM); |
| + if (maybe_failure->IsFailure()) return maybe_failure; |
| + } |
| return prototype; |
| } |