Chromium Code Reviews
chromiumcodereview-hr@appspot.gserviceaccount.com (chromiumcodereview-hr) | Please choose your nickname with Settings | Help | Chromium Project | Gerrit Changes | Sign out
(5)

Side by Side Diff: src/objects.cc

Issue 15955010: Fix non-idempotent modification in JSObject::AddFastProperty. (Closed) Base URL: https://v8.googlecode.com/svn/branches/bleeding_edge
Patch Set: Created 7 years, 6 months ago
Use n/p to move between diff chunks; N/P to move between comments. Draft comments are only viewable by you.
Jump to:
View unified diff | Download patch | Annotate | Revision Log
« no previous file with comments | « no previous file | no next file » | no next file with comments »
Toggle Intra-line Diffs ('i') | Expand Comments ('e') | Collapse Comments ('c') | Show Comments Hide Comments ('s')
OLDNEW
1 // Copyright 2013 the V8 project authors. All rights reserved. 1 // Copyright 2013 the V8 project authors. All rights reserved.
2 // Redistribution and use in source and binary forms, with or without 2 // Redistribution and use in source and binary forms, with or without
3 // modification, are permitted provided that the following conditions are 3 // modification, are permitted provided that the following conditions are
4 // met: 4 // met:
5 // 5 //
6 // * Redistributions of source code must retain the above copyright 6 // * Redistributions of source code must retain the above copyright
7 // notice, this list of conditions and the following disclaimer. 7 // notice, this list of conditions and the following disclaimer.
8 // * Redistributions in binary form must reproduce the above 8 // * Redistributions in binary form must reproduce the above
9 // copyright notice, this list of conditions and the following 9 // copyright notice, this list of conditions and the following
10 // disclaimer in the documentation and/or other materials provided 10 // disclaimer in the documentation and/or other materials provided
(...skipping 1806 matching lines...) Expand 10 before | Expand all | Expand 10 after
1817 // Make room for the new value 1817 // Make room for the new value
1818 MaybeObject* maybe_values = 1818 MaybeObject* maybe_values =
1819 properties()->CopySize(properties()->length() + kFieldsAdded); 1819 properties()->CopySize(properties()->length() + kFieldsAdded);
1820 if (!maybe_values->To(&values)) return maybe_values; 1820 if (!maybe_values->To(&values)) return maybe_values;
1821 } 1821 }
1822 1822
1823 TransitionFlag flag = INSERT_TRANSITION; 1823 TransitionFlag flag = INSERT_TRANSITION;
1824 1824
1825 Heap* heap = isolate->heap(); 1825 Heap* heap = isolate->heap();
1826 1826
1827 Map* new_map;
1828 MaybeObject* maybe_new_map = map()->CopyAddDescriptor(&new_field, flag);
1829 if (!maybe_new_map->To(&new_map)) return maybe_new_map;
1830
1831 Object* storage; 1827 Object* storage;
1832 MaybeObject* maybe_storage = 1828 MaybeObject* maybe_storage =
1833 value->AllocateNewStorageFor(heap, representation); 1829 value->AllocateNewStorageFor(heap, representation);
1834 if (!maybe_storage->To(&storage)) return maybe_storage; 1830 if (!maybe_storage->To(&storage)) return maybe_storage;
1835 1831
1832 // Note that Map::CopyAddDescriptor has side-effects, the new map is already
1833 // inserted in the transition tree. No more allocations that might fail are
1834 // allowed after this point.
1835 Map* new_map;
1836 MaybeObject* maybe_new_map = map()->CopyAddDescriptor(&new_field, flag);
1837 if (!maybe_new_map->To(&new_map)) return maybe_new_map;
1838
1836 if (map()->unused_property_fields() == 0) { 1839 if (map()->unused_property_fields() == 0) {
1837 ASSERT(values != NULL); 1840 ASSERT(values != NULL);
1838 set_properties(values); 1841 set_properties(values);
1839 new_map->set_unused_property_fields(kFieldsAdded - 1); 1842 new_map->set_unused_property_fields(kFieldsAdded - 1);
1840 } else { 1843 } else {
1841 new_map->set_unused_property_fields(map()->unused_property_fields() - 1); 1844 new_map->set_unused_property_fields(map()->unused_property_fields() - 1);
1842 } 1845 }
1843 1846
1844 set_map(new_map); 1847 set_map(new_map);
1845 1848
(...skipping 13791 matching lines...) Expand 10 before | Expand all | Expand 10 after
15637 set_year(Smi::FromInt(year), SKIP_WRITE_BARRIER); 15640 set_year(Smi::FromInt(year), SKIP_WRITE_BARRIER);
15638 set_month(Smi::FromInt(month), SKIP_WRITE_BARRIER); 15641 set_month(Smi::FromInt(month), SKIP_WRITE_BARRIER);
15639 set_day(Smi::FromInt(day), SKIP_WRITE_BARRIER); 15642 set_day(Smi::FromInt(day), SKIP_WRITE_BARRIER);
15640 set_weekday(Smi::FromInt(weekday), SKIP_WRITE_BARRIER); 15643 set_weekday(Smi::FromInt(weekday), SKIP_WRITE_BARRIER);
15641 set_hour(Smi::FromInt(hour), SKIP_WRITE_BARRIER); 15644 set_hour(Smi::FromInt(hour), SKIP_WRITE_BARRIER);
15642 set_min(Smi::FromInt(min), SKIP_WRITE_BARRIER); 15645 set_min(Smi::FromInt(min), SKIP_WRITE_BARRIER);
15643 set_sec(Smi::FromInt(sec), SKIP_WRITE_BARRIER); 15646 set_sec(Smi::FromInt(sec), SKIP_WRITE_BARRIER);
15644 } 15647 }
15645 15648
15646 } } // namespace v8::internal 15649 } } // namespace v8::internal
OLDNEW
« no previous file with comments | « no previous file | no next file » | no next file with comments »

Powered by Google App Engine
This is Rietveld 408576698