| Index: src/elements.cc
|
| diff --git a/src/elements.cc b/src/elements.cc
|
| index 9ab70bbfaf692e6aa572320cd37515ba91c886e6..c9d6276a5e7dd9bd399c7c4066a7f82d03b26ac5 100644
|
| --- a/src/elements.cc
|
| +++ b/src/elements.cc
|
| @@ -1572,16 +1572,20 @@ class FastElementsAccessor : public ElementsAccessorBase<Subclass, KindTraits> {
|
| static void ValidateContents(Handle<JSObject> holder, int length) {
|
| #if DEBUG
|
| Isolate* isolate = holder->GetIsolate();
|
| + Heap* heap = isolate->heap();
|
| HandleScope scope(isolate);
|
| Handle<FixedArrayBase> elements(holder->elements(), isolate);
|
| Map* map = elements->map();
|
| - DCHECK((IsFastSmiOrObjectElementsKind(KindTraits::Kind) &&
|
| - (map == isolate->heap()->fixed_array_map() ||
|
| - map == isolate->heap()->fixed_cow_array_map())) ||
|
| - (IsFastDoubleElementsKind(KindTraits::Kind) ==
|
| - ((map == isolate->heap()->fixed_array_map() && length == 0) ||
|
| - map == isolate->heap()->fixed_double_array_map())));
|
| + if (IsFastSmiOrObjectElementsKind(KindTraits::Kind)) {
|
| + DCHECK_NE(map, heap->fixed_double_array_map());
|
| + } else if (IsFastDoubleElementsKind(KindTraits::Kind)) {
|
| + DCHECK_NE(map, heap->fixed_cow_array_map());
|
| + if (map == heap->fixed_array_map()) DCHECK_EQ(0, length);
|
| + } else {
|
| + UNREACHABLE();
|
| + }
|
| if (length == 0) return; // nothing to do!
|
| +#if ENABLE_SLOW_DCHECKS
|
| DisallowHeapAllocation no_gc;
|
| Handle<BackingStore> backing_store = Handle<BackingStore>::cast(elements);
|
| if (IsFastSmiElementsKind(KindTraits::Kind)) {
|
| @@ -1590,8 +1594,16 @@ class FastElementsAccessor : public ElementsAccessorBase<Subclass, KindTraits> {
|
| (IsFastHoleyElementsKind(KindTraits::Kind) &&
|
| backing_store->is_the_hole(i)));
|
| }
|
| + } else if (KindTraits::Kind == FAST_ELEMENTS ||
|
| + KindTraits::Kind == FAST_DOUBLE_ELEMENTS) {
|
| + for (int i = 0; i < length; i++) {
|
| + DCHECK(!backing_store->is_the_hole(i));
|
| + }
|
| + } else {
|
| + DCHECK(IsFastHoleyElementsKind(KindTraits::Kind));
|
| }
|
| #endif
|
| +#endif
|
| }
|
|
|
| static Handle<Object> PopImpl(Handle<JSArray> receiver) {
|
| @@ -1805,7 +1817,7 @@ class FastElementsAccessor : public ElementsAccessorBase<Subclass, KindTraits> {
|
| static uint32_t AddArguments(Handle<JSArray> receiver,
|
| Handle<FixedArrayBase> backing_store,
|
| Arguments* args, uint32_t add_size,
|
| - Where remove_position) {
|
| + Where add_position) {
|
| uint32_t length = Smi::cast(receiver->length())->value();
|
| DCHECK(0 < add_size);
|
| uint32_t elms_len = backing_store->length();
|
| @@ -1817,13 +1829,13 @@ class FastElementsAccessor : public ElementsAccessorBase<Subclass, KindTraits> {
|
| // New backing storage is needed.
|
| uint32_t capacity = JSObject::NewElementsCapacity(new_length);
|
| // If we add arguments to the start we have to shift the existing objects.
|
| - int copy_dst_index = remove_position == AT_START ? add_size : 0;
|
| + int copy_dst_index = add_position == AT_START ? add_size : 0;
|
| // Copy over all objects to a new backing_store.
|
| backing_store = Subclass::ConvertElementsWithCapacity(
|
| receiver, backing_store, KindTraits::Kind, capacity, 0,
|
| copy_dst_index, ElementsAccessor::kCopyToEndAndInitializeToHole);
|
| receiver->set_elements(*backing_store);
|
| - } else if (remove_position == AT_START) {
|
| + } else if (add_position == AT_START) {
|
| // If the backing store has enough capacity and we add elements to the
|
| // start we have to shift the existing objects.
|
| Isolate* isolate = receiver->GetIsolate();
|
| @@ -1831,7 +1843,7 @@ class FastElementsAccessor : public ElementsAccessorBase<Subclass, KindTraits> {
|
| length, 0, 0);
|
| }
|
|
|
| - int insertion_index = remove_position == AT_START ? 0 : length;
|
| + int insertion_index = add_position == AT_START ? 0 : length;
|
| // Copy the arguments to the start.
|
| Subclass::CopyArguments(args, backing_store, add_size, 1, insertion_index);
|
| // Set the length.
|
| @@ -1847,8 +1859,9 @@ class FastElementsAccessor : public ElementsAccessorBase<Subclass, KindTraits> {
|
| FixedArrayBase* raw_backing_store = *dst_store;
|
| WriteBarrierMode mode = raw_backing_store->GetWriteBarrierMode(no_gc);
|
| for (uint32_t i = 0; i < copy_size; i++) {
|
| - Object* argument = (*args)[i + src_index];
|
| - Subclass::SetImpl(raw_backing_store, i + dst_index, argument, mode);
|
| + Object* argument = (*args)[src_index + i];
|
| + DCHECK(!argument->IsTheHole());
|
| + Subclass::SetImpl(raw_backing_store, dst_index + i, argument, mode);
|
| }
|
| }
|
| };
|
| @@ -2916,7 +2929,7 @@ MaybeHandle<Object> ArrayConstructInitializeElements(Handle<JSArray> array,
|
| }
|
|
|
| // Fill in the content
|
| - switch (array->GetElementsKind()) {
|
| + switch (elements_kind) {
|
| case FAST_HOLEY_SMI_ELEMENTS:
|
| case FAST_SMI_ELEMENTS: {
|
| Handle<FixedArray> smi_elms = Handle<FixedArray>::cast(elms);
|
|
|