Reviewers: Michael Achenbach,
Description:
Version 3.26.31.11 (merged r21859, r21907)
Do not eliminate bounds checks for "<const> - x".
Add missing map check to optimized f.apply(...)
BUG=385054,386034
LOG=N
[email protected]
Please review this at https://codereview.chromium.org/371323002/
SVN Base: https://v8.googlecode.com/svn/branches/3.26
Affected files (+23, -26 lines):
M src/hydrogen.cc
M src/hydrogen-bce.cc
M src/version.cc
A + test/mjsunit/regress/regress-385054.js
A + test/mjsunit/regress/regress-386034.js
Index: src/hydrogen-bce.cc
diff --git a/src/hydrogen-bce.cc b/src/hydrogen-bce.cc
index
1f3f449a0c317b26c8c6cd99a4d86cc60f0266d0..5f45c1fd0dc5383dab9d4714b504407f2c7fa8e2
100644
--- a/src/hydrogen-bce.cc
+++ b/src/hydrogen-bce.cc
@@ -47,10 +47,7 @@ class BoundsCheckKey : public ZoneObject {
} else if (check->index()->IsSub()) {
HSub* index = HSub::cast(check->index());
is_sub = true;
- if (index->left()->IsConstant()) {
- constant = HConstant::cast(index->left());
- index_base = index->right();
- } else if (index->right()->IsConstant()) {
+ if (index->right()->IsConstant()) {
constant = HConstant::cast(index->right());
index_base = index->left();
}
Index: src/hydrogen.cc
diff --git a/src/hydrogen.cc b/src/hydrogen.cc
index
6ecd5cc5f297404e084adca640a46e2d4cdc32cf..846798da70abd67bde62f6c99eab5c89583b1f28
100644
--- a/src/hydrogen.cc
+++ b/src/hydrogen.cc
@@ -8011,10 +8011,12 @@ bool HOptimizedGraphBuilder::TryCallApply(Call*
expr) {
HValue* function = Pop(); // f
Drop(1); // apply
+ HValue* checked_function = AddCheckMap(function, function_map);
+
if (function_state()->outer() == NULL) {
HInstruction* elements = Add<HArgumentsElements>(false);
HInstruction* length = Add<HArgumentsLength>(elements);
- HValue* wrapped_receiver = BuildWrapReceiver(receiver, function);
+ HValue* wrapped_receiver = BuildWrapReceiver(receiver,
checked_function);
HInstruction* result = New<HApplyArguments>(function,
wrapped_receiver,
length,
@@ -8030,7 +8032,7 @@ bool HOptimizedGraphBuilder::TryCallApply(Call* expr)
{
const ZoneList<HValue*>* arguments_values = args->arguments_values();
int arguments_count = arguments_values->length();
Push(function);
- Push(BuildWrapReceiver(receiver, function));
+ Push(BuildWrapReceiver(receiver, checked_function));
for (int i = 1; i < arguments_count; i++) {
Push(arguments_values->at(i));
}
Index: src/version.cc
diff --git a/src/version.cc b/src/version.cc
index
de2743eb25b97dbc8cd4b5d60add72348da93a0b..9833a1ba33c65c09e9466360db5808355867dd5f
100644
--- a/src/version.cc
+++ b/src/version.cc
@@ -35,7 +35,7 @@
#define MAJOR_VERSION 3
#define MINOR_VERSION 26
#define BUILD_NUMBER 31
-#define PATCH_LEVEL 10
+#define PATCH_LEVEL 11
// Use 1 for candidates and 0 otherwise.
// (Boolean macro values are not supported by all preprocessors.)
#define IS_CANDIDATE_VERSION 0
Index: test/mjsunit/regress/regress-385054.js
diff --git a/test/mjsunit/regress/regress-alloc-smi-check.js
b/test/mjsunit/regress/regress-385054.js
similarity index 69%
copy from test/mjsunit/regress/regress-alloc-smi-check.js
copy to test/mjsunit/regress/regress-385054.js
index
295048a13ef862ceb21939de104e7968dd7772da..115bca0d21989e2a82325aeb66d8c06aa5ab198c
100644
--- a/test/mjsunit/regress/regress-alloc-smi-check.js
+++ b/test/mjsunit/regress/regress-385054.js
@@ -1,16 +1,16 @@
// Copyright 2014 the V8 project authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
-//
-// Flags: --allow-natives-syntax
-var x = {};
+// Flags: --allow-natives-syntax
-function f(a) {
- a[200000000] = x;
+function f(x) {
+ var a = [1, 2];
+ a[x];
+ return a[0 - x];
}
-f(new Array(100000));
-f([]);
+f(0);
+f(0);
%OptimizeFunctionOnNextCall(f);
-f([]);
+assertEquals(undefined, f(1));
Index: test/mjsunit/regress/regress-386034.js
diff --git
a/test/mjsunit/regress/regress-no-dummy-use-for-arguments-object.js
b/test/mjsunit/regress/regress-386034.js
similarity index 58%
copy from test/mjsunit/regress/regress-no-dummy-use-for-arguments-object.js
copy to test/mjsunit/regress/regress-386034.js
index
658d776ea3b80cd00d256a5514603bdb3df1f179..d770ce91bd64ad6e1307b1b699948b2513359efc
100644
--- a/test/mjsunit/regress/regress-no-dummy-use-for-arguments-object.js
+++ b/test/mjsunit/regress/regress-386034.js
@@ -4,18 +4,16 @@
// Flags: --allow-natives-syntax
-function g() {
- arguments.length;
+function f(x) {
+ var v = x;
+ for (i = 0; i < 1; i++) {
+ v.apply(this, arguments);
+ }
}
-var global = "";
+function g() {}
-function f() {
- global.dummy = this;
- g({});
-}
-
-f();
-f();
+f(g);
+f(g);
%OptimizeFunctionOnNextCall(f);
-f();
+assertThrows(function() { f('----'); }, TypeError);
--
--
v8-dev mailing list
[email protected]
http://groups.google.com/group/v8-dev
---
You received this message because you are subscribed to the Google Groups "v8-dev" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
For more options, visit https://groups.google.com/d/optout.
