Commit 885a8816 authored by machenbach's avatar machenbach Committed by Commit bot

Revert of Invalidate the global property cell when converting from data to...

Revert of Invalidate the global property cell when converting from data to accessor. (patchset #1 id:1 of https://codereview.chromium.org/961003002/)

Reason for revert:
Breaks gc stress, e.g.: http://build.chromium.org/p/client.v8/builders/V8%20GC%20Stress%20-%201/builds/2322

Original issue's description:
> Invalidate the global property cell when converting from data to accessor.
>
> BUG=
> TBR=jkummerow@chromium.org,
>
> Committed: https://crrev.com/6a12dc240b1faffa500ff269077d832ecc74239d
> Cr-Commit-Position: refs/heads/master@{#26896}

TBR=jkummerow@chromium.org,verwaest@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=

Review URL: https://codereview.chromium.org/958113004

Cr-Commit-Position: refs/heads/master@{#26899}
parent da710f95
......@@ -95,7 +95,7 @@ class PropertyHandlerCompiler : public PropertyAccessCompiler {
Register CheckPrototypes(Register object_reg, Register holder_reg,
Register scratch1, Register scratch2,
Handle<Name> name, Label* miss,
PrototypeCheckType check);
PrototypeCheckType check = CHECK_ALL_MAPS);
Handle<Code> GetCode(Code::Kind kind, Code::StubType type, Handle<Name> name);
void set_holder(Handle<JSObject> holder) { holder_ = holder; }
......
......@@ -565,15 +565,7 @@ void JSObject::SetNormalizedProperty(Handle<JSObject> object,
if (object->IsGlobalObject()) {
Handle<PropertyCell> cell(
PropertyCell::cast(property_dictionary->ValueAt(entry)));
if (details.type() != property_dictionary->DetailsAt(entry).type()) {
Isolate* isolate = object->GetIsolate();
Handle<Object> hole = isolate->factory()->the_hole_value();
PropertyCell::SetValueInferType(cell, hole);
cell = isolate->factory()->NewPropertyCell(value);
property_dictionary->SetEntry(entry, name, cell, details);
} else {
PropertyCell::SetValueInferType(cell, value);
}
PropertyCell::SetValueInferType(cell, value);
// Please note we have to update the property details.
property_dictionary->DetailsAtPut(entry, details);
} else {
......@@ -7440,7 +7432,12 @@ Handle<Map> Map::TransitionToAccessorProperty(Handle<Map> map,
Isolate* isolate = name->GetIsolate();
// Dictionary maps can always have additional data properties.
if (map->is_dictionary_map()) return map;
if (map->is_dictionary_map()) {
// For global objects, property cells are inlined. We need to change the
// map.
if (map->IsGlobalObjectMap()) return Copy(map, "GlobalAccessor");
return map;
}
// Migrate to the newest map before transitioning to the new property.
map = Update(map);
......
// Copyright 2015 the V8 project authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
function f(o) {
return o.x;
}
this.x = 100;
f(this);
f(this);
f(this);
Object.defineProperty(this, 'x', { get: function() { return 10; }});
assertEquals(10, this.x);
assertEquals(10, f(this));
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment