Browse Source

Fix performance regression caused by r11202.

R=erik.corry@gmail.com
BUG=v8:2156,v8:2034
TEST=mjsunit/regress/regress-2156,mjsunit/regress/regress-2034

Review URL: https://chromiumcodereview.appspot.com/10539131

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@11800 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
v0.9.1-release
mstarzinger@chromium.org 13 years ago
committed by Bert Belder
parent
commit
48893af7bb
  1. 31
      deps/v8/src/objects.cc
  2. 13
      deps/v8/src/objects.h
  3. 39
      deps/v8/test/mjsunit/regress/regress-2156.js

31
deps/v8/src/objects.cc

@ -1720,11 +1720,13 @@ MaybeObject* JSObject::AddProperty(String* name,
Object* value, Object* value,
PropertyAttributes attributes, PropertyAttributes attributes,
StrictModeFlag strict_mode, StrictModeFlag strict_mode,
JSReceiver::StoreFromKeyed store_mode) { JSReceiver::StoreFromKeyed store_mode,
ExtensibilityCheck extensibility_check) {
ASSERT(!IsJSGlobalProxy()); ASSERT(!IsJSGlobalProxy());
Map* map_of_this = map(); Map* map_of_this = map();
Heap* heap = GetHeap(); Heap* heap = GetHeap();
if (!map_of_this->is_extensible()) { if (extensibility_check == PERFORM_EXTENSIBILITY_CHECK &&
!map_of_this->is_extensible()) {
if (strict_mode == kNonStrictMode) { if (strict_mode == kNonStrictMode) {
return value; return value;
} else { } else {
@ -1763,7 +1765,8 @@ MaybeObject* JSObject::SetPropertyPostInterceptor(
String* name, String* name,
Object* value, Object* value,
PropertyAttributes attributes, PropertyAttributes attributes,
StrictModeFlag strict_mode) { StrictModeFlag strict_mode,
ExtensibilityCheck extensibility_check) {
// Check local property, ignore interceptor. // Check local property, ignore interceptor.
LookupResult result(GetIsolate()); LookupResult result(GetIsolate());
LocalLookupRealNamedProperty(name, &result); LocalLookupRealNamedProperty(name, &result);
@ -1778,7 +1781,8 @@ MaybeObject* JSObject::SetPropertyPostInterceptor(
SetPropertyViaPrototypes(name, value, attributes, strict_mode, &done); SetPropertyViaPrototypes(name, value, attributes, strict_mode, &done);
if (done) return result_object; if (done) return result_object;
// Add a new real property. // Add a new real property.
return AddProperty(name, value, attributes, strict_mode); return AddProperty(name, value, attributes, strict_mode,
MAY_BE_STORE_FROM_KEYED, extensibility_check);
} }
@ -1935,7 +1939,8 @@ MaybeObject* JSObject::SetPropertyWithInterceptor(
this_handle->SetPropertyPostInterceptor(*name_handle, this_handle->SetPropertyPostInterceptor(*name_handle,
*value_handle, *value_handle,
attributes, attributes,
strict_mode); strict_mode,
PERFORM_EXTENSIBILITY_CHECK);
RETURN_IF_SCHEDULED_EXCEPTION(isolate); RETURN_IF_SCHEDULED_EXCEPTION(isolate);
return raw_result; return raw_result;
} }
@ -3664,11 +3669,14 @@ MaybeObject* JSObject::GetHiddenPropertiesDictionary(bool create_if_absent) {
MaybeObject* dict_alloc = StringDictionary::Allocate(kInitialSize); MaybeObject* dict_alloc = StringDictionary::Allocate(kInitialSize);
StringDictionary* dictionary; StringDictionary* dictionary;
if (!dict_alloc->To<StringDictionary>(&dictionary)) return dict_alloc; if (!dict_alloc->To<StringDictionary>(&dictionary)) return dict_alloc;
// Using AddProperty or SetPropertyPostInterceptor here could fail, because MaybeObject* store_result =
// object might be non-extensible. SetPropertyPostInterceptor(GetHeap()->hidden_symbol(),
return HasFastProperties() dictionary,
? AddFastProperty(GetHeap()->hidden_symbol(), dictionary, DONT_ENUM) DONT_ENUM,
: AddSlowProperty(GetHeap()->hidden_symbol(), dictionary, DONT_ENUM); kNonStrictMode,
OMIT_EXTENSIBILITY_CHECK);
if (store_result->IsFailure()) return store_result;
return dictionary;
} }
@ -3697,7 +3705,8 @@ MaybeObject* JSObject::SetHiddenPropertiesDictionary(
SetPropertyPostInterceptor(GetHeap()->hidden_symbol(), SetPropertyPostInterceptor(GetHeap()->hidden_symbol(),
dictionary, dictionary,
DONT_ENUM, DONT_ENUM,
kNonStrictMode); kNonStrictMode,
OMIT_EXTENSIBILITY_CHECK);
if (store_result->IsFailure()) return store_result; if (store_result->IsFailure()) return store_result;
return this; return this;
} }

13
deps/v8/src/objects.h

@ -1369,6 +1369,13 @@ class JSReceiver: public HeapObject {
CERTAINLY_NOT_STORE_FROM_KEYED CERTAINLY_NOT_STORE_FROM_KEYED
}; };
// Internal properties (e.g. the hidden properties dictionary) might
// be added even though the receiver is non-extensible.
enum ExtensibilityCheck {
PERFORM_EXTENSIBILITY_CHECK,
OMIT_EXTENSIBILITY_CHECK
};
// Casting. // Casting.
static inline JSReceiver* cast(Object* obj); static inline JSReceiver* cast(Object* obj);
@ -1567,7 +1574,8 @@ class JSObject: public JSReceiver {
String* name, String* name,
Object* value, Object* value,
PropertyAttributes attributes, PropertyAttributes attributes,
StrictModeFlag strict_mode); StrictModeFlag strict_mode,
ExtensibilityCheck extensibility_check);
static Handle<Object> SetLocalPropertyIgnoreAttributes( static Handle<Object> SetLocalPropertyIgnoreAttributes(
Handle<JSObject> object, Handle<JSObject> object,
@ -1959,7 +1967,8 @@ class JSObject: public JSReceiver {
Object* value, Object* value,
PropertyAttributes attributes, PropertyAttributes attributes,
StrictModeFlag strict_mode, StrictModeFlag strict_mode,
StoreFromKeyed store_mode = MAY_BE_STORE_FROM_KEYED); StoreFromKeyed store_mode = MAY_BE_STORE_FROM_KEYED,
ExtensibilityCheck extensibility_check = PERFORM_EXTENSIBILITY_CHECK);
// Convert the object to use the canonical dictionary // Convert the object to use the canonical dictionary
// representation. If the object is expected to have additional properties // representation. If the object is expected to have additional properties

39
deps/v8/test/mjsunit/regress/regress-2156.js

@ -0,0 +1,39 @@
// Copyright 2012 the V8 project authors. All rights reserved.
// Redistribution and use in source and binary forms, with or without
// modification, are permitted provided that the following conditions are
// met:
//
// * Redistributions of source code must retain the above copyright
// notice, this list of conditions and the following disclaimer.
// * Redistributions in binary form must reproduce the above
// copyright notice, this list of conditions and the following
// disclaimer in the documentation and/or other materials provided
// with the distribution.
// * Neither the name of Google Inc. nor the names of its
// contributors may be used to endorse or promote products derived
// from this software without specific prior written permission.
//
// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
// Flags: --allow-natives-syntax --harmony-collections
var key1 = {};
var key2 = {};
var map = new WeakMap;
// Adding hidden properties preserves map sharing. Putting the key into
// a WeakMap will cause the first hidden property to be added.
assertTrue(%HaveSameMap(key1, key2));
map.set(key1, 1);
map.set(key2, 2);
assertTrue(%HaveSameMap(key1, key2));
Loading…
Cancel
Save