Version 3.22.0
LiveEdit to mark more closure functions for re-instantiation when scope layout changes. (issue 2872)
Made bounds check elimination iterative instead of recursive. (Chromium issue 289706)
Turned on i18n support by default.
Set the proper instance-type on HAllocate in BuildFastLiteral. (Chromium issue 284577)
Performance and stability improvements on all platforms.
git-svn-id: http://v8.googlecode.com/svn/trunk@16891 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
diff --git a/src/objects-debug.cc b/src/objects-debug.cc
index 5d9e161..ad13d7f 100644
--- a/src/objects-debug.cc
+++ b/src/objects-debug.cc
@@ -330,10 +330,11 @@
}
}
- // TODO(hpayer): deal gracefully with partially constructed JSObjects, when
- // allocation folding is turned off.
- if (reinterpret_cast<Map*>(elements()) !=
- GetHeap()->one_pointer_filler_map()) {
+ // If a GC was caused while constructing this object, the elements
+ // pointer may point to a one pointer filler map.
+ if ((FLAG_use_gvn && FLAG_use_allocation_folding) ||
+ (reinterpret_cast<Map*>(elements()) !=
+ GetHeap()->one_pointer_filler_map())) {
CHECK_EQ((map()->has_fast_smi_or_object_elements() ||
(elements() == GetHeap()->empty_fixed_array())),
(elements()->map() == GetHeap()->fixed_array_map() ||
@@ -683,10 +684,11 @@
void JSArray::JSArrayVerify() {
JSObjectVerify();
CHECK(length()->IsNumber() || length()->IsUndefined());
- // TODO(hpayer): deal gracefully with partially constructed JSObjects, when
- // allocation folding is turned off.
- if (reinterpret_cast<Map*>(elements()) !=
- GetHeap()->one_pointer_filler_map()) {
+ // If a GC was caused while constructing this array, the elements
+ // pointer may point to a one pointer filler map.
+ if ((FLAG_use_gvn && FLAG_use_allocation_folding) ||
+ (reinterpret_cast<Map*>(elements()) !=
+ GetHeap()->one_pointer_filler_map())) {
CHECK(elements()->IsUndefined() ||
elements()->IsFixedArray() ||
elements()->IsFixedDoubleArray());