Commit c80d730c authored by hpayer's avatar hpayer Committed by Commit bot

Initialize sub-array literals first before pointing to it.

BUG=484544
LOG=n

Review URL: https://codereview.chromium.org/1132763002

Cr-Commit-Position: refs/heads/master@{#28313}
parent f9c46ed1
......@@ -11338,13 +11338,16 @@ HInstruction* HOptimizedGraphBuilder::BuildFastLiteral(
object_elements =
Add<HAllocate>(object_elements_size, HType::HeapObject(),
pretenure_flag, instance_type, current_site);
}
BuildInitElementsInObjectHeader(boilerplate_object, object, object_elements);
// Copy object elements if non-COW.
if (object_elements != NULL) {
BuildEmitElements(boilerplate_object, elements, object_elements,
site_context);
Add<HStoreNamedField>(object, HObjectAccess::ForElementsPointer(),
object_elements);
} else {
Handle<Object> elements_field =
Handle<Object>(boilerplate_object->elements(), isolate());
HInstruction* object_elements_cow = Add<HConstant>(elements_field);
Add<HStoreNamedField>(object, HObjectAccess::ForElementsPointer(),
object_elements_cow);
}
// Copy in-object properties.
......@@ -11386,21 +11389,6 @@ void HOptimizedGraphBuilder::BuildEmitObjectHeader(
}
void HOptimizedGraphBuilder::BuildInitElementsInObjectHeader(
Handle<JSObject> boilerplate_object,
HInstruction* object,
HInstruction* object_elements) {
DCHECK(boilerplate_object->properties()->length() == 0);
if (object_elements == NULL) {
Handle<Object> elements_field =
Handle<Object>(boilerplate_object->elements(), isolate());
object_elements = Add<HConstant>(elements_field);
}
Add<HStoreNamedField>(object, HObjectAccess::ForElementsPointer(),
object_elements);
}
void HOptimizedGraphBuilder::BuildEmitInObjectProperties(
Handle<JSObject> boilerplate_object,
HInstruction* object,
......
......@@ -2818,10 +2818,6 @@ class HOptimizedGraphBuilder : public HGraphBuilder, public AstVisitor {
void BuildEmitObjectHeader(Handle<JSObject> boilerplate_object,
HInstruction* object);
void BuildInitElementsInObjectHeader(Handle<JSObject> boilerplate_object,
HInstruction* object,
HInstruction* object_elements);
void BuildEmitInObjectProperties(Handle<JSObject> boilerplate_object,
HInstruction* object,
AllocationSiteUsageContext* site_context,
......
// Copyright 2015 the V8 project authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
//
// Flags: --nouse-allocation-folding --stress-compaction --predictable
function f() {
return [[], [], [[], [], []]];
}
for (var i=0; i<10000; i++) {
f();
}
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment