Revision: 22601
Author: [email protected]
Date: Thu Jul 24 13:38:05 2014 UTC
Log: Revert 22595: "Keep new arrays allocated with 'new Array(N)' in
fast mode"
Due to failures in mjsunit/array-functions-prototype-misc
[email protected]
Review URL: https://codereview.chromium.org/417953004
http://code.google.com/p/v8/source/detail?r=22601
Modified:
/branches/bleeding_edge/src/elements.cc
/branches/bleeding_edge/src/objects.cc
/branches/bleeding_edge/src/runtime.cc
/branches/bleeding_edge/src/runtime.h
/branches/bleeding_edge/test/fuzz-natives/base.js
/branches/bleeding_edge/test/mjsunit/allocation-site-info.js
/branches/bleeding_edge/test/mjsunit/apply.js
/branches/bleeding_edge/test/mjsunit/array-constructor-feedback.js
/branches/bleeding_edge/test/mjsunit/array-feedback.js
/branches/bleeding_edge/test/mjsunit/array-splice.js
/branches/bleeding_edge/test/mjsunit/array-unshift.js
/branches/bleeding_edge/test/mjsunit/elements-kind.js
/branches/bleeding_edge/test/mjsunit/es7/object-observe.js
/branches/bleeding_edge/test/mjsunit/polymorph-arrays.js
/branches/bleeding_edge/test/mjsunit/regress/regress-2790.js
/branches/bleeding_edge/tools/generate-runtime-tests.py
=======================================
--- /branches/bleeding_edge/src/elements.cc Thu Jul 24 12:08:23 2014 UTC
+++ /branches/bleeding_edge/src/elements.cc Thu Jul 24 13:38:05 2014 UTC
@@ -897,7 +897,8 @@
typedef typename KindTraits::BackingStore BackingStore;
- // Adjusts the length of the fast backing store..
+ // Adjusts the length of the fast backing store or returns the new
length or
+ // undefined in case conversion to a slow backing store should be
performed.
static Handle<Object> SetLengthWithoutNormalize(
Handle<FixedArrayBase> backing_store,
Handle<JSArray> array,
@@ -949,10 +950,15 @@
// Check whether the backing store should be expanded.
uint32_t min = JSObject::NewElementsCapacity(old_capacity);
uint32_t new_capacity = length > min ? length : min;
- FastElementsAccessorSubclass::SetFastElementsCapacityAndLength(
- array, new_capacity, length);
- JSObject::ValidateElements(array);
- return length_object;
+ if (!array->ShouldConvertToSlowElements(new_capacity)) {
+ FastElementsAccessorSubclass::SetFastElementsCapacityAndLength(
+ array, new_capacity, length);
+ JSObject::ValidateElements(array);
+ return length_object;
+ }
+
+ // Request conversion to slow elements.
+ return isolate->factory()->undefined_value();
}
static Handle<Object> DeleteCommon(Handle<JSObject> obj,
=======================================
--- /branches/bleeding_edge/src/objects.cc Thu Jul 24 12:08:23 2014 UTC
+++ /branches/bleeding_edge/src/objects.cc Thu Jul 24 13:38:05 2014 UTC
@@ -11720,17 +11720,6 @@
MaybeHandle<Object> JSArray::SetElementsLength(
Handle<JSArray> array,
Handle<Object> new_length_handle) {
- if (array->HasFastElements()) {
- // If the new array won't fit in a some non-trivial fraction of the
max old
- // space size, then force it to go dictionary mode.
- int max_fast_array_size = static_cast<int>(
- (array->GetHeap()->MaxOldGenerationSize() / kDoubleSize) / 4);
- if (new_length_handle->IsNumber() &&
- NumberToInt32(*new_length_handle) >= max_fast_array_size) {
- NormalizeElements(array);
- }
- }
-
// We should never end in here with a pixel or external array.
ASSERT(array->AllowsSetElementsLength());
if (!array->map()->is_observed()) {
=======================================
--- /branches/bleeding_edge/src/runtime.cc Thu Jul 24 12:08:23 2014 UTC
+++ /branches/bleeding_edge/src/runtime.cc Thu Jul 24 13:38:05 2014 UTC
@@ -10576,30 +10576,7 @@
ASSERT(args.length() == 2);
CONVERT_ARG_HANDLE_CHECKED(JSObject, array, 0);
CONVERT_NUMBER_CHECKED(uint32_t, length, Uint32, args[1]);
-
- ElementsKind kind = array->GetElementsKind();
- bool estimate_keys_as_length = IsFastPackedElementsKind(kind);
- if (IsHoleyElementsKind(kind)) {
- ElementsAccessor* accessor = array->GetElementsAccessor();
- // If more than 10% of the array is holes, then calculate the key set,
it's
- // much faster than using the runtime to walk the prototype chain in
the
- // hole case.
- int holes = 0;
- int length = array->elements()->length();
- for (int i = 0; i < length; ++i) {
- if (!accessor->HasElement(array, array, i)) {
- ++holes;
- }
- }
- estimate_keys_as_length = holes < static_cast<int>(length / 10);
- }
-
- if (estimate_keys_as_length) {
- RUNTIME_ASSERT(array->HasFastSmiOrObjectElements() ||
- array->HasFastDoubleElements());
- uint32_t actual_length =
static_cast<uint32_t>(array->elements()->length());
- return *isolate->factory()->NewNumberFromUint(Min(actual_length,
length));
- } else {
+ if (array->elements()->IsDictionary()) {
Handle<FixedArray> keys = isolate->factory()->empty_fixed_array();
for (PrototypeIterator iter(isolate, array,
PrototypeIterator::START_AT_RECEIVER);
@@ -10626,6 +10603,11 @@
if (NumberToUint32(keys->get(i)) >= length) keys->set_undefined(i);
}
return *isolate->factory()->NewJSArrayWithElements(keys);
+ } else {
+ RUNTIME_ASSERT(array->HasFastSmiOrObjectElements() ||
+ array->HasFastDoubleElements());
+ uint32_t actual_length =
static_cast<uint32_t>(array->elements()->length());
+ return *isolate->factory()->NewNumberFromUint(Min(actual_length,
length));
}
}
@@ -14947,15 +14929,6 @@
Handle<AllocationSite>::null(),
caller_args);
}
-
-
-RUNTIME_FUNCTION(Runtime_NormalizeElements) {
- HandleScope scope(isolate);
- ASSERT(args.length() == 1);
- CONVERT_ARG_HANDLE_CHECKED(JSObject, array, 0);
- JSObject::NormalizeElements(array);
- return *array;
-}
RUNTIME_FUNCTION(Runtime_MaxSmi) {
=======================================
--- /branches/bleeding_edge/src/runtime.h Thu Jul 24 12:08:23 2014 UTC
+++ /branches/bleeding_edge/src/runtime.h Thu Jul 24 13:38:05 2014 UTC
@@ -440,7 +440,6 @@
/* Arrays */ \
F(ArrayConstructor, -1, 1) \
F(InternalArrayConstructor, -1, 1) \
- F(NormalizeElements, 1, 1) \
\
/* Literals */ \
F(MaterializeRegExpLiteral, 4, 1) \
=======================================
--- /branches/bleeding_edge/test/fuzz-natives/base.js Thu Jul 24 12:08:23
2014 UTC
+++ /branches/bleeding_edge/test/fuzz-natives/base.js Thu Jul 24 13:38:05
2014 UTC
@@ -2,8 +2,6 @@
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
-// Flags: --allow-natives-syntax
-
// TODO(jkummerow): There are many ways to improve these tests, e.g.:
// - more variance in randomized inputs
// - better time complexity management
@@ -17,9 +15,7 @@
result.push(17);
result.push(-31);
result.push(new Array(100));
- var a = %NormalizeElements([]);
- a.length = 100003;
- result.push(a);
+ result.push(new Array(100003));
result.push(Number.MIN_VALUE);
result.push("whoops");
result.push("x");
=======================================
--- /branches/bleeding_edge/test/mjsunit/allocation-site-info.js Thu Jul 24
12:08:23 2014 UTC
+++ /branches/bleeding_edge/test/mjsunit/allocation-site-info.js Thu Jul 24
13:38:05 2014 UTC
@@ -297,6 +297,10 @@
assertKind(elements_kind.fast_double, obj);
obj = newarraycase_onearg(0, 5);
assertKind(elements_kind.fast_double, obj);
+// Now pass a length that forces the dictionary path.
+obj = newarraycase_onearg(100000, 5);
+assertKind(elements_kind.dictionary, obj);
+assertTrue(obj.length == 100000);
// Verify that cross context calls work
var realmA = Realm.current();
=======================================
--- /branches/bleeding_edge/test/mjsunit/apply.js Thu Jul 24 12:08:23 2014
UTC
+++ /branches/bleeding_edge/test/mjsunit/apply.js Thu Jul 24 13:38:05 2014
UTC
@@ -25,8 +25,6 @@
// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
-// Flags: --allow-natives-syntax
-
function f0() {
return this;
}
@@ -116,8 +114,7 @@
for (var j = 1; j < 0x40000000; j <<= 1) {
try {
- var a = %NormalizeElements([]);
- a.length = j;
+ var a = new Array(j);
a[j - 1] = 42;
assertEquals(42 + j, al.apply(345, a));
} catch (e) {
@@ -125,8 +122,7 @@
for (; j < 0x40000000; j <<= 1) {
var caught = false;
try {
- a = %NormalizeElements([]);
- a.length = j;
+ a = new Array(j);
a[j - 1] = 42;
al.apply(345, a);
assertUnreachable("Apply of array with length " + a.length +
=======================================
--- /branches/bleeding_edge/test/mjsunit/array-constructor-feedback.js Thu
Jul 24 12:08:23 2014 UTC
+++ /branches/bleeding_edge/test/mjsunit/array-constructor-feedback.js Thu
Jul 24 13:38:05 2014 UTC
@@ -130,7 +130,8 @@
a = bar(10);
assertKind(elements_kind.fast, a);
assertOptimized(bar);
- bar(100000);
+ a = bar(100000);
+ assertKind(elements_kind.dictionary, a);
assertOptimized(bar);
// If the argument isn't a smi, things should still work.
=======================================
--- /branches/bleeding_edge/test/mjsunit/array-feedback.js Thu Jul 24
12:08:23 2014 UTC
+++ /branches/bleeding_edge/test/mjsunit/array-feedback.js Thu Jul 24
13:38:05 2014 UTC
@@ -92,7 +92,7 @@
assertKind(elements_kind.fast, b);
a = create1(100000);
- assertKind(elements_kind.fast_smi_only, a);
+ assertKind(elements_kind.dictionary, a);
function create3(arg1, arg2, arg3) {
return Array(arg1, arg2, arg3);
=======================================
--- /branches/bleeding_edge/test/mjsunit/array-splice.js Thu Jul 24
12:08:23 2014 UTC
+++ /branches/bleeding_edge/test/mjsunit/array-splice.js Thu Jul 24
13:38:05 2014 UTC
@@ -25,8 +25,6 @@
// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
-// Flags: --allow-natives-syntax
-
// Check that splicing array of holes keeps it as array of holes
(function() {
for (var i = 0; i < 7; i++) {
@@ -359,9 +357,7 @@
(function() {
for (var i = 0; i < 7; i++) {
try {
- var a = %NormalizeElements([]);
- a.length = Math.pow(2, 32) - 3;
- a.splice(-1, 0, 1, 2, 3, 4, 5);
+ new Array(Math.pow(2, 32) - 3).splice(-1, 0, 1, 2, 3, 4, 5);
throw 'Should have thrown RangeError';
} catch (e) {
assertTrue(e instanceof RangeError);
@@ -369,8 +365,7 @@
// Check smi boundary
var bigNum = (1 << 30) - 3;
- var array = %NormalizeElements([]);
- array.length = bigNum;
+ var array = new Array(bigNum);
array.splice(-1, 0, 1, 2, 3, 4, 5, 6, 7);
assertEquals(bigNum + 7, array.length);
}
=======================================
--- /branches/bleeding_edge/test/mjsunit/array-unshift.js Thu Jul 24
12:08:23 2014 UTC
+++ /branches/bleeding_edge/test/mjsunit/array-unshift.js Thu Jul 24
13:38:05 2014 UTC
@@ -194,9 +194,7 @@
(function() {
for (var i = 0; i < 7; i++) {
try {
- var a1 = [];
- a1[Math.pow(2, 32) - 3 - 1] = 0;
- a1.unshift(1, 2, 3, 4, 5);
+ new Array(Math.pow(2, 32) - 3).unshift(1, 2, 3, 4, 5);
throw 'Should have thrown RangeError';
} catch (e) {
assertTrue(e instanceof RangeError);
@@ -204,9 +202,7 @@
// Check smi boundary
var bigNum = (1 << 30) - 3;
- var a2 = [];
- a2[bigNum - 1] = 0;
- assertEquals(bigNum + 7, a2.unshift(1, 2, 3, 4, 5, 6, 7));
+ assertEquals(bigNum + 7, new Array(bigNum).unshift(1, 2, 3, 4, 5, 6,
7));
}
})();
=======================================
--- /branches/bleeding_edge/test/mjsunit/elements-kind.js Thu Jul 24
12:08:23 2014 UTC
+++ /branches/bleeding_edge/test/mjsunit/elements-kind.js Thu Jul 24
13:38:05 2014 UTC
@@ -145,9 +145,7 @@
}
assertKind(elements_kind.fast, you);
- var temp = [];
- temp[0xDECAF] = 0;
- assertKind(elements_kind.dictionary, temp);
+ assertKind(elements_kind.dictionary, new Array(0xDECAF));
var fast_double_array = new Array(0xDECAF);
for (var i = 0; i < 0xDECAF; i++) fast_double_array[i] = i / 2;
=======================================
--- /branches/bleeding_edge/test/mjsunit/es7/object-observe.js Thu Jul 24
12:08:23 2014 UTC
+++ /branches/bleeding_edge/test/mjsunit/es7/object-observe.js Thu Jul 24
13:38:05 2014 UTC
@@ -1234,9 +1234,8 @@
// Updating length on large (slow) array
reset();
-var slow_arr = %NormalizeElements([]);
+var slow_arr = new Array(1000000000);
slow_arr[500000000] = 'hello';
-slow_arr.length = 1000000000;
Object.observe(slow_arr, observer.callback);
var spliceRecords;
function slowSpliceCallback(records) {
=======================================
--- /branches/bleeding_edge/test/mjsunit/polymorph-arrays.js Thu Jul 24
12:08:23 2014 UTC
+++ /branches/bleeding_edge/test/mjsunit/polymorph-arrays.js Thu Jul 24
13:38:05 2014 UTC
@@ -37,7 +37,7 @@
a[i] = i;
}
a[5000000] = 256;
- return %NormalizeElements(a);
+ assertTrue(%HasDictionaryElements(a));
}
function testPolymorphicLoads() {
@@ -49,7 +49,7 @@
var object_array = new Object;
var sparse_object_array = new Object;
var js_array = new Array(10);
- var sparse_js_array = %NormalizeElements([]);
+ var sparse_js_array = new Array(5000001);
init_array(object_array);
init_array(js_array);
@@ -67,7 +67,7 @@
var object_array = new Object;
var sparse_object_array = new Object;
var js_array = new Array(10);
- var sparse_js_array = %NormalizeElements([]);
+ var sparse_js_array = new Array(5000001);
init_array(object_array);
init_array(js_array);
@@ -114,8 +114,7 @@
var object_array = new Object;
var sparse_object_array = new Object;
var js_array = new Array(10);
- var sparse_js_array = [];
- sparse_js_array.length = 5000001;
+ var sparse_js_array = new Array(5000001);
init_array(object_array);
init_array(js_array);
@@ -133,8 +132,7 @@
var object_array = new Object;
var sparse_object_array = new Object;
var js_array = new Array(10);
- var sparse_js_array = %NormalizeElements([]);
- sparse_js_array.length = 5000001;
+ var sparse_js_array = new Array(5000001);
init_array(object_array);
init_array(js_array);
=======================================
--- /branches/bleeding_edge/test/mjsunit/regress/regress-2790.js Thu Jul 24
12:08:23 2014 UTC
+++ /branches/bleeding_edge/test/mjsunit/regress/regress-2790.js Thu Jul 24
13:38:05 2014 UTC
@@ -26,6 +26,6 @@
// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
// Test that we can create arrays of any size.
-for (var i = 1000; i < 1000000; i += 19703) {
+for (var i = 1000; i < 1000000; i += 197) {
new Array(i);
}
=======================================
--- /branches/bleeding_edge/tools/generate-runtime-tests.py Thu Jul 24
12:08:23 2014 UTC
+++ /branches/bleeding_edge/tools/generate-runtime-tests.py Thu Jul 24
13:38:05 2014 UTC
@@ -47,7 +47,7 @@
# that the parser doesn't bit-rot. Change the values as needed when you
add,
# remove or change runtime functions, but make sure we don't lose our
ability
# to parse them!
-EXPECTED_FUNCTION_COUNT = 421
+EXPECTED_FUNCTION_COUNT = 420
EXPECTED_FUZZABLE_COUNT = 335
EXPECTED_CCTEST_COUNT = 8
EXPECTED_UNKNOWN_COUNT = 4
@@ -124,7 +124,6 @@
# Arrays
"ArrayConstructor",
"InternalArrayConstructor",
- "NormalizeElements",
# Literals
"MaterializeRegExpLiteral",
--
--
v8-dev mailing list
[email protected]
http://groups.google.com/group/v8-dev
---
You received this message because you are subscribed to the Google Groups "v8-dev" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
For more options, visit https://groups.google.com/d/optout.
