Commit 04a0223a authored by hpayer@chromium.org's avatar hpayer@chromium.org

Initialize elements pointer in BuildCloneShallowArray when allocation folding is turned off.

BUG=
R=mvstanton@chromium.org

Review URL: https://codereview.chromium.org/219173003

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@20843 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
parent 49b19ecd
......@@ -2620,6 +2620,15 @@ HValue* HGraphBuilder::BuildCloneShallowArray(HValue* boilerplate,
object, Add<HConstant>(JSArray::kSize), allocation_site);
}
// We have to initialize the elements pointer if allocation folding is
// turned off.
if (!FLAG_use_gvn || !FLAG_use_allocation_folding) {
HConstant* empty_fixed_array = Add<HConstant>(
isolate()->factory()->empty_fixed_array());
Add<HStoreNamedField>(object, HObjectAccess::ForElementsPointer(),
empty_fixed_array, INITIALIZING_STORE);
}
if (length > 0) {
HValue* boilerplate_elements = AddLoadElements(boilerplate);
HValue* object_elements;
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment