Reviewers: Igor Sheludko,
Description:
Version 3.27.34.8 (merged r22616, r22617)
In GrowMode, force the value to the right representation to avoid deopts
between
storing the length and storing the value.
Smi arrays are only guaranteed to be initialized in non-holey case
BUG=16459193
LOG=y
[email protected]
Please review this at https://codereview.chromium.org/424623003/
SVN Base: https://v8.googlecode.com/svn/branches/3.27
Affected files (+30, -33 lines):
M src/hydrogen.cc
M src/hydrogen-instructions.h
M src/version.cc
A + test/mjsunit/regress/regress-grow-deopt.js
Index: src/hydrogen-instructions.h
diff --git a/src/hydrogen-instructions.h b/src/hydrogen-instructions.h
index
f1720f444247d83635c84d00a99cf2457ee0022e..47ce499481d5784a9f8e32604d3b9f81a9213dfc
100644
--- a/src/hydrogen-instructions.h
+++ b/src/hydrogen-instructions.h
@@ -6906,19 +6906,28 @@ class HStoreKeyed V8_FINAL
}
ASSERT_EQ(index, 2);
- if (IsDoubleOrFloatElementsKind(elements_kind())) {
+ return RequiredValueRepresentation(elements_kind_, store_mode_);
+ }
+
+ static Representation RequiredValueRepresentation(
+ ElementsKind kind, StoreFieldOrKeyedMode mode) {
+ if (IsDoubleOrFloatElementsKind(kind)) {
return Representation::Double();
}
- if (SmiValuesAre32Bits() && store_mode_ == STORE_TO_INITIALIZED_ENTRY)
{
+
+ if (kind == FAST_SMI_ELEMENTS && SmiValuesAre32Bits() &&
+ mode == STORE_TO_INITIALIZED_ENTRY) {
return Representation::Integer32();
}
- if (IsFastSmiElementsKind(elements_kind())) {
+
+ if (IsFastSmiElementsKind(kind)) {
return Representation::Smi();
}
- return is_external() || is_fixed_typed_array()
- ? Representation::Integer32()
- : Representation::Tagged();
+ return IsExternalArrayElementsKind(kind) ||
+ IsFixedTypedArrayElementsKind(kind)
+ ? Representation::Integer32()
+ : Representation::Tagged();
}
bool is_external() const {
@@ -6938,20 +6947,10 @@ class HStoreKeyed V8_FINAL
if (IsUninitialized()) {
return Representation::None();
}
- if (IsDoubleOrFloatElementsKind(elements_kind())) {
- return Representation::Double();
- }
- if (SmiValuesAre32Bits() && store_mode_ == STORE_TO_INITIALIZED_ENTRY)
{
- return Representation::Integer32();
- }
- if (IsFastSmiElementsKind(elements_kind())) {
- return Representation::Smi();
- }
- if (is_typed_elements()) {
- return Representation::Integer32();
- }
+ Representation r = RequiredValueRepresentation(elements_kind_,
store_mode_);
// For fast object elements kinds, don't assume anything.
- return Representation::None();
+ if (r.IsTagged()) return Representation::None();
+ return r;
}
HValue* elements() const { return OperandAt(0); }
@@ -7031,9 +7030,6 @@ class HStoreKeyed V8_FINAL
SetOperandAt(1, key);
SetOperandAt(2, val);
- ASSERT(store_mode != STORE_TO_INITIALIZED_ENTRY ||
- elements_kind == FAST_SMI_ELEMENTS);
-
if (IsFastObjectElementsKind(elements_kind)) {
SetFlag(kTrackSideEffectDominators);
SetDependsOnFlag(kNewSpacePromotion);
Index: src/hydrogen.cc
diff --git a/src/hydrogen.cc b/src/hydrogen.cc
index
6e5ea741bdd0524973f41d487a780d4b0c5c68a8..8fff497eea9f1da5752b5af2342a3508acd7c833
100644
--- a/src/hydrogen.cc
+++ b/src/hydrogen.cc
@@ -2405,6 +2405,9 @@ HInstruction*
HGraphBuilder::BuildUncheckedMonomorphicElementAccess(
if (IsGrowStoreMode(store_mode)) {
NoObservableSideEffectsScope no_effects(this);
+ Representation representation =
HStoreKeyed::RequiredValueRepresentation(
+ elements_kind, STORE_TO_INITIALIZED_ENTRY);
+ val = AddUncasted<HForceRepresentation>(val, representation);
elements = BuildCheckForCapacityGrow(checked_object, elements,
elements_kind, length, key,
is_js_array, access_type);
@@ -2601,9 +2604,7 @@ HInstruction* HGraphBuilder::AddElementAccess(
val = Add<HClampToUint8>(val);
}
return Add<HStoreKeyed>(elements, checked_key, val, elements_kind,
- elements_kind == FAST_SMI_ELEMENTS
- ? STORE_TO_INITIALIZED_ENTRY
- : INITIALIZING_STORE);
+ STORE_TO_INITIALIZED_ENTRY);
}
ASSERT(access_type == LOAD);
Index: src/version.cc
diff --git a/src/version.cc b/src/version.cc
index
21200e71c9e164c34588048ca7415769f6dbf1bd..2e972ba8da535df3410985db1741dc807eb75a8d
100644
--- a/src/version.cc
+++ b/src/version.cc
@@ -35,7 +35,7 @@
#define MAJOR_VERSION 3
#define MINOR_VERSION 27
#define BUILD_NUMBER 34
-#define PATCH_LEVEL 7
+#define PATCH_LEVEL 8
// Use 1 for candidates and 0 otherwise.
// (Boolean macro values are not supported by all preprocessors.)
#define IS_CANDIDATE_VERSION 0
Index: test/mjsunit/regress/regress-grow-deopt.js
diff --git a/test/mjsunit/regress/regress-385054.js
b/test/mjsunit/regress/regress-grow-deopt.js
similarity index 68%
copy from test/mjsunit/regress/regress-385054.js
copy to test/mjsunit/regress/regress-grow-deopt.js
index
115bca0d21989e2a82325aeb66d8c06aa5ab198c..df3a83fe8b9cea5309b9bf810acb60b7c3901708
100644
--- a/test/mjsunit/regress/regress-385054.js
+++ b/test/mjsunit/regress/regress-grow-deopt.js
@@ -4,13 +4,13 @@
// Flags: --allow-natives-syntax
-function f(x) {
- var a = [1, 2];
- a[x];
- return a[0 - x];
+function f(a, v) {
+ a[a.length] = v;
}
-f(0);
-f(0);
+var a = [1.4];
+f(a, 1);
+f(a, 2);
%OptimizeFunctionOnNextCall(f);
-assertEquals(undefined, f(1));
+f(a, {});
+assertEquals(4, a.length);
--
--
v8-dev mailing list
[email protected]
http://groups.google.com/group/v8-dev
---
You received this message because you are subscribed to the Google Groups "v8-dev" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
For more options, visit https://groups.google.com/d/optout.
