| OLD | NEW |
| 1 // Copyright 2014 the V8 project authors. All rights reserved. | 1 // Copyright 2014 the V8 project authors. All rights reserved. |
| 2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
| 3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
| 4 | 4 |
| 5 #include <stdlib.h> | 5 #include <stdlib.h> |
| 6 #include <utility> | 6 #include <utility> |
| 7 | 7 |
| 8 #include "src/v8.h" | 8 #include "src/v8.h" |
| 9 | 9 |
| 10 #include "src/compilation-cache.h" | 10 #include "src/compilation-cache.h" |
| (...skipping 19 matching lines...) Expand all Loading... |
| 30 return HeapNumber::cast(value)->value(); | 30 return HeapNumber::cast(value)->value(); |
| 31 } | 31 } |
| 32 } | 32 } |
| 33 | 33 |
| 34 | 34 |
| 35 enum PropertyKind { | 35 enum PropertyKind { |
| 36 PROP_CONSTANT, | 36 PROP_CONSTANT, |
| 37 PROP_SMI, | 37 PROP_SMI, |
| 38 PROP_DOUBLE, | 38 PROP_DOUBLE, |
| 39 PROP_TAGGED, | 39 PROP_TAGGED, |
| 40 PROP_KIND_NUMBER, | 40 PROP_KIND_NUMBER |
| 41 }; | 41 }; |
| 42 | 42 |
| 43 static Representation representations[PROP_KIND_NUMBER] = { | 43 static Representation representations[PROP_KIND_NUMBER] = { |
| 44 Representation::None(), Representation::Smi(), Representation::Double(), | 44 Representation::None(), Representation::Smi(), Representation::Double(), |
| 45 Representation::Tagged()}; | 45 Representation::Tagged()}; |
| 46 | 46 |
| 47 | 47 |
| 48 static Handle<DescriptorArray> CreateDescriptorArray(Isolate* isolate, | 48 static Handle<DescriptorArray> CreateDescriptorArray(Isolate* isolate, |
| 49 PropertyKind* props, | 49 PropertyKind* props, |
| 50 int kPropsCount) { | 50 int kPropsCount) { |
| (...skipping 595 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 646 // Create temp object in the new space. | 646 // Create temp object in the new space. |
| 647 Handle<JSArray> temp = factory->NewJSArray(FAST_ELEMENTS, NOT_TENURED); | 647 Handle<JSArray> temp = factory->NewJSArray(FAST_ELEMENTS, NOT_TENURED); |
| 648 CHECK(isolate->heap()->new_space()->Contains(*temp)); | 648 CHECK(isolate->heap()->new_space()->Contains(*temp)); |
| 649 | 649 |
| 650 // Construct a double value that looks like a pointer to the new space object | 650 // Construct a double value that looks like a pointer to the new space object |
| 651 // and store it into the obj. | 651 // and store it into the obj. |
| 652 Address fake_object = reinterpret_cast<Address>(*temp) + kPointerSize; | 652 Address fake_object = reinterpret_cast<Address>(*temp) + kPointerSize; |
| 653 double boom_value = bit_cast<double>(fake_object); | 653 double boom_value = bit_cast<double>(fake_object); |
| 654 | 654 |
| 655 FieldIndex field_index = FieldIndex::ForDescriptor(obj->map(), 0); | 655 FieldIndex field_index = FieldIndex::ForDescriptor(obj->map(), 0); |
| 656 obj->FastPropertyAtPut(field_index, | 656 Handle<HeapNumber> boom_number = factory->NewHeapNumber(boom_value, MUTABLE); |
| 657 *factory->NewHeapNumber(boom_value, MUTABLE)); | 657 obj->FastPropertyAtPut(field_index, *boom_number); |
| 658 | 658 |
| 659 // Enforce scan on scavenge for the obj's page. | 659 // Enforce scan on scavenge for the obj's page. |
| 660 MemoryChunk* chunk = MemoryChunk::FromAddress(obj->address()); | 660 MemoryChunk* chunk = MemoryChunk::FromAddress(obj->address()); |
| 661 chunk->set_scan_on_scavenge(true); | 661 chunk->set_scan_on_scavenge(true); |
| 662 | 662 |
| 663 // Trigger GCs and force evacuation. Should not crash there. | 663 // Trigger GCs and force evacuation. Should not crash there. |
| 664 CcTest::heap()->CollectAllGarbage(i::Heap::kNoGCFlags); | 664 CcTest::heap()->CollectAllGarbage(i::Heap::kNoGCFlags); |
| 665 | 665 |
| 666 CHECK_EQ(boom_value, GetDoubleFieldValue(*obj, field_index)); | 666 CHECK_EQ(boom_value, GetDoubleFieldValue(*obj, field_index)); |
| 667 } | 667 } |
| 668 | 668 |
| 669 #endif | 669 #endif |
| OLD | NEW |