| Index: src/arm/full-codegen-arm.cc
|
| diff --git a/src/arm/full-codegen-arm.cc b/src/arm/full-codegen-arm.cc
|
| index 85e94f29649dacf999f1fbf7afd4415a6f48bfb0..54dc5a1da7c0ba9ad2a21ea212f9b279fdd4cf73 100644
|
| --- a/src/arm/full-codegen-arm.cc
|
| +++ b/src/arm/full-codegen-arm.cc
|
| @@ -2729,26 +2729,31 @@ void FullCodeGenerator::EmitIsStringWrapperSafeForDefaultValueOf(
|
| __ b(eq, if_false);
|
|
|
| // Look for valueOf symbol in the descriptor array, and indicate false if
|
| - // found. The type is not checked, so if it is a transition it is a false
|
| - // negative.
|
| - __ LoadInstanceDescriptors(r1, r4, r3);
|
| - __ ldr(r3, FieldMemOperand(r4, FixedArray::kLengthOffset));
|
| - // r4: descriptor array
|
| - // r3: length of descriptor array
|
| - // Calculate the end of the descriptor array.
|
| + // found. Since we omit an enumeration index check, if it is added via a
|
| + // transition that shares its descriptor array, this is a false positive.
|
| + Label entry, loop, done;
|
| +
|
| + // Skip loop if no descriptors are valid.
|
| + __ NumberOfOwnDescriptors(r3, r1);
|
| + __ cmp(r3, Operand(0));
|
| + __ b(eq, &done);
|
| +
|
| + __ LoadInstanceDescriptors(r1, r4, r2);
|
| + // r4: descriptor array.
|
| + // r3: valid entries in the descriptor array.
|
| STATIC_ASSERT(kSmiTag == 0);
|
| STATIC_ASSERT(kSmiTagSize == 1);
|
| STATIC_ASSERT(kPointerSize == 4);
|
| - __ add(r2, r4, Operand(FixedArray::kHeaderSize - kHeapObjectTag));
|
| + __ mov(ip, Operand(DescriptorArray::kDescriptorSize));
|
| + __ mul(r3, r3, ip);
|
| + // Calculate location of the first key name.
|
| + __ add(r4, r4, Operand(DescriptorArray::kFirstOffset - kHeapObjectTag));
|
| + // Calculate the end of the descriptor array.
|
| + __ mov(r2, r4);
|
| __ add(r2, r2, Operand(r3, LSL, kPointerSizeLog2 - kSmiTagSize));
|
|
|
| - // Calculate location of the first key name.
|
| - __ add(r4,
|
| - r4,
|
| - Operand(DescriptorArray::kFirstOffset - kHeapObjectTag));
|
| // Loop through all the keys in the descriptor array. If one of these is the
|
| // symbol valueOf the result is false.
|
| - Label entry, loop;
|
| // The use of ip to store the valueOf symbol asumes that it is not otherwise
|
| // used in the loop below.
|
| __ mov(ip, Operand(FACTORY->value_of_symbol()));
|
| @@ -2762,7 +2767,8 @@ void FullCodeGenerator::EmitIsStringWrapperSafeForDefaultValueOf(
|
| __ cmp(r4, Operand(r2));
|
| __ b(ne, &loop);
|
|
|
| - // If a valueOf property is not found on the object check that it's
|
| + __ bind(&done);
|
| + // If a valueOf property is not found on the object check that its
|
| // prototype is the un-modified String prototype. If not result is false.
|
| __ ldr(r2, FieldMemOperand(r1, Map::kPrototypeOffset));
|
| __ JumpIfSmi(r2, if_false);
|
|
|