commit e97852de34e44a479f092bd2449134e707cd9cf1
author dslomov@chromium.org <dslomov@chromium.org@ce2b1a6d-e550-0410-aec6-3dcde31c8c00> Thu Sep 12 09:02:59 2013 +0000
committer dslomov@chromium.org <dslomov@chromium.org@ce2b1a6d-e550-0410-aec6-3dcde31c8c00> Thu Sep 12 09:02:59 2013 +0000
tree 9d1993d465c5be74e23a1c909bacefe8c58e5c01
parent c5d4971574b7a205fa0e788d8121dc79485e5e67

Version 3.21.14

Added access check for observed objects. (V8 issue 2778)

Cleaned up v8::ArrayBuffer::Allocator interface. (V8 issue 2823)

Performance and stability improvements on all platforms.

git-svn-id: http://v8.googlecode.com/svn/trunk@16670 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

src/objects-debug.cc

diff --git a/src/objects-debug.cc b/src/objects-debug.cc
index 883afe9..3716df1 100644
--- a/src/objects-debug.cc
+++ b/src/objects-debug.cc
@@ -329,11 +329,17 @@
       }
     }
   }
-  CHECK_EQ((map()->has_fast_smi_or_object_elements() ||
-             (elements() == GetHeap()->empty_fixed_array())),
-            (elements()->map() == GetHeap()->fixed_array_map() ||
-             elements()->map() == GetHeap()->fixed_cow_array_map()));
-  CHECK(map()->has_fast_object_elements() == HasFastObjectElements());
+
+  // TODO(hpayer): deal gracefully with partially constructed JSObjects, when
+  // allocation folding is turned off.
+  if (reinterpret_cast<Map*>(elements()) !=
+      GetHeap()->one_pointer_filler_map()) {
+    CHECK_EQ((map()->has_fast_smi_or_object_elements() ||
+              (elements() == GetHeap()->empty_fixed_array())),
+             (elements()->map() == GetHeap()->fixed_array_map() ||
+              elements()->map() == GetHeap()->fixed_cow_array_map()));
+    CHECK(map()->has_fast_object_elements() == HasFastObjectElements());
+  }
 }
 
 
@@ -677,9 +683,19 @@
 void JSArray::JSArrayVerify() {
   JSObjectVerify();
   CHECK(length()->IsNumber() || length()->IsUndefined());
-  CHECK(elements()->IsUndefined() ||
-         elements()->IsFixedArray() ||
-         elements()->IsFixedDoubleArray());
+  // TODO(hpayer): deal gracefully with partially constructed JSObjects, when
+  // allocation folding is turned off.
+  if (reinterpret_cast<Map*>(elements()) !=
+      GetHeap()->one_pointer_filler_map()) {
+    CHECK(elements()->IsUndefined() ||
+          elements()->IsFixedArray() ||
+          elements()->IsFixedDoubleArray());
+    // TODO(mvstanton): to diagnose chromium bug 284577, remove after.
+    AllocationMemento* memento = AllocationMemento::FindForJSObject(this);
+    if (memento != NULL && memento->IsValid()) {
+      memento->AllocationMementoVerify();
+    }
+  }
 }