Chromium Code Reviews
chromiumcodereview-hr@appspot.gserviceaccount.com (chromiumcodereview-hr) | Please choose your nickname with Settings | Help | Chromium Project | Gerrit Changes | Sign out
(342)

Side by Side Diff: src/lookup.cc

Issue 904423002: fix transition of typedarrays in ics (Closed) Base URL: https://chromium.googlesource.com/v8/v8.git@master
Patch Set: Created 5 years, 10 months ago
Use n/p to move between diff chunks; N/P to move between comments. Draft comments are only viewable by you.
Jump to:
View unified diff | Download patch
« no previous file with comments | « src/ic/ic.cc ('k') | test/mjsunit/harmony/regress/regress-typedarray-out-of-bounds.js » ('j') | no next file with comments »
Toggle Intra-line Diffs ('i') | Expand Comments ('e') | Collapse Comments ('c') | Show Comments Hide Comments ('s')
OLDNEW
1 // Copyright 2014 the V8 project authors. All rights reserved. 1 // Copyright 2014 the V8 project authors. All rights reserved.
2 // Use of this source code is governed by a BSD-style license that can be 2 // Use of this source code is governed by a BSD-style license that can be
3 // found in the LICENSE file. 3 // found in the LICENSE file.
4 4
5 #include "src/v8.h" 5 #include "src/v8.h"
6 6
7 #include "src/bootstrapper.h" 7 #include "src/bootstrapper.h"
8 #include "src/deoptimizer.h" 8 #include "src/deoptimizer.h"
9 #include "src/lookup.h" 9 #include "src/lookup.h"
10 #include "src/lookup-inl.h" 10 #include "src/lookup-inl.h"
(...skipping 102 matching lines...) Expand 10 before | Expand all | Expand 10 after
113 ReloadPropertyInformation(); 113 ReloadPropertyInformation();
114 } 114 }
115 115
116 116
117 void LookupIterator::PrepareTransitionToDataProperty( 117 void LookupIterator::PrepareTransitionToDataProperty(
118 Handle<Object> value, PropertyAttributes attributes, 118 Handle<Object> value, PropertyAttributes attributes,
119 Object::StoreFromKeyed store_mode) { 119 Object::StoreFromKeyed store_mode) {
120 if (state_ == TRANSITION) return; 120 if (state_ == TRANSITION) return;
121 DCHECK(state_ != LookupIterator::ACCESSOR); 121 DCHECK(state_ != LookupIterator::ACCESSOR);
122 DCHECK(state_ == NOT_FOUND || !HolderIsReceiverOrHiddenPrototype()); 122 DCHECK(state_ == NOT_FOUND || !HolderIsReceiverOrHiddenPrototype());
123 123 DCHECK(!IsSpecialNumericIndex());
124 // Can only be called when the receiver is a JSObject. JSProxy has to be 124 // Can only be called when the receiver is a JSObject. JSProxy has to be
125 // handled via a trap. Adding properties to primitive values is not 125 // handled via a trap. Adding properties to primitive values is not
126 // observable. 126 // observable.
127 Handle<JSObject> receiver = GetStoreTarget(); 127 Handle<JSObject> receiver = GetStoreTarget();
128 128
129 if (!isolate()->IsInternallyUsedPropertyName(name()) && 129 if (!isolate()->IsInternallyUsedPropertyName(name()) &&
130 !receiver->map()->is_extensible()) { 130 !receiver->map()->is_extensible()) {
131 return; 131 return;
132 } 132 }
133 133
(...skipping 203 matching lines...) Expand 10 before | Expand all | Expand 10 after
337 } 337 }
338 return false; 338 return false;
339 } 339 }
340 340
341 341
342 void LookupIterator::InternalizeName() { 342 void LookupIterator::InternalizeName() {
343 if (name_->IsUniqueName()) return; 343 if (name_->IsUniqueName()) return;
344 name_ = factory()->InternalizeString(Handle<String>::cast(name_)); 344 name_ = factory()->InternalizeString(Handle<String>::cast(name_));
345 } 345 }
346 } } // namespace v8::internal 346 } } // namespace v8::internal
OLDNEW
« no previous file with comments | « src/ic/ic.cc ('k') | test/mjsunit/harmony/regress/regress-typedarray-out-of-bounds.js » ('j') | no next file with comments »

Powered by Google App Engine
This is Rietveld 408576698