Merged r16790 into trunk branch.
Set the proper instance-type on HAllocate in BuildFastLiteral
BUG=chromium:284577
R=danno@chromium.org
Review URL: https://codereview.chromium.org/23536065
git-svn-id: http://v8.googlecode.com/svn/trunk@16802 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
diff --git a/src/hydrogen.cc b/src/hydrogen.cc
index 23c373f..15ef5ed 100644
--- a/src/hydrogen.cc
+++ b/src/hydrogen.cc
@@ -8186,8 +8186,9 @@
int object_size = boilerplate_object->map()->instance_size();
int object_offset = object_size;
+ InstanceType instance_type = boilerplate_object->map()->instance_type();
bool create_allocation_site_info = mode == TRACK_ALLOCATION_SITE &&
- AllocationSite::CanTrack(boilerplate_object->map()->instance_type());
+ AllocationSite::CanTrack(instance_type);
// If using allocation sites, then the payload on the site should already
// be filled in as a valid (boilerplate) array.
@@ -8198,9 +8199,12 @@
object_size += AllocationMemento::kSize;
}
+ ASSERT(instance_type == JS_ARRAY_TYPE || instance_type == JS_OBJECT_TYPE);
+ HType type = instance_type == JS_ARRAY_TYPE
+ ? HType::JSArray() : HType::JSObject();
HValue* object_size_constant = Add<HConstant>(object_size);
- HInstruction* object = Add<HAllocate>(object_size_constant, HType::JSObject(),
- isolate()->heap()->GetPretenureMode(), JS_OBJECT_TYPE);
+ HInstruction* object = Add<HAllocate>(object_size_constant, type,
+ isolate()->heap()->GetPretenureMode(), instance_type);
BuildEmitObjectHeader(boilerplate_object, object);
diff --git a/src/version.cc b/src/version.cc
index 91df195..0b4b10d 100644
--- a/src/version.cc
+++ b/src/version.cc
@@ -35,7 +35,7 @@
#define MAJOR_VERSION 3
#define MINOR_VERSION 21
#define BUILD_NUMBER 18
-#define PATCH_LEVEL 0
+#define PATCH_LEVEL 1
// Use 1 for candidates and 0 otherwise.
// (Boolean macro values are not supported by all preprocessors.)
#define IS_CANDIDATE_VERSION 0