Reviewers: Benedikt Meurer,
Description:
Fix inaccurate type condition in Hydrogen
[email protected]
BUG=
Please review this at https://codereview.chromium.org/550453003/
SVN Base: https://v8.googlecode.com/svn/branches/bleeding_edge
Affected files (+6, -8 lines):
M src/hydrogen.cc
A + test/mjsunit/regress/regress-cr412210.js
Index: src/hydrogen.cc
diff --git a/src/hydrogen.cc b/src/hydrogen.cc
index
35efe630aab242a6a88060021c55dd40c01df178..fddb8b020f3b8b64e332ba2471467cc74609c4c6
100644
--- a/src/hydrogen.cc
+++ b/src/hydrogen.cc
@@ -10253,7 +10253,7 @@ HValue* HGraphBuilder::BuildBinaryOperation(
right_type->Maybe(Type::String()) ||
right_type->Maybe(Type::Receiver()));
- if (left_type->Is(Type::None())) {
+ if (!left_type->IsInhabited()) {
Add<HDeoptimize>("Insufficient type feedback for LHS of binary
operation",
Deoptimizer::SOFT);
// TODO(rossberg): we should be able to get rid of non-continuous
@@ -10264,7 +10264,7 @@ HValue* HGraphBuilder::BuildBinaryOperation(
left_rep = Representation::FromType(left_type);
}
- if (right_type->Is(Type::None())) {
+ if (!right_type->IsInhabited()) {
Add<HDeoptimize>("Insufficient type feedback for RHS of binary
operation",
Deoptimizer::SOFT);
right_type = Type::Any(zone());
@@ -10761,7 +10761,7 @@ HControlInstruction*
HOptimizedGraphBuilder::BuildCompareInstruction(
BailoutId bailout_id) {
// Cases handled below depend on collected type feedback. They should
// soft deoptimize when there is no type feedback.
- if (combined_type->Is(Type::None())) {
+ if (!combined_type->IsInhabited()) {
Add<HDeoptimize>("Insufficient type feedback for combined type "
"of binary operation",
Deoptimizer::SOFT);
Index: test/mjsunit/regress/regress-cr412210.js
diff --git a/test/mjsunit/regress/regress-crbug-387636.js
b/test/mjsunit/regress/regress-cr412210.js
similarity index 81%
copy from test/mjsunit/regress/regress-crbug-387636.js
copy to test/mjsunit/regress/regress-cr412210.js
index
1e50ace45a293c8561042f1a09c8fcd505b43dc2..6ec7d62379c2dbc511da1c29d96216637e1fcae1
100644
--- a/test/mjsunit/regress/regress-crbug-387636.js
+++ b/test/mjsunit/regress/regress-cr412210.js
@@ -4,11 +4,9 @@
// Flags: --allow-natives-syntax
-function f() {
- [].indexOf(0x40000000);
-}
+function f(x) {
+ return (x ? "" >> 0 : "") + /a/;
+};
-f();
-f();
%OptimizeFunctionOnNextCall(f);
f();
--
--
v8-dev mailing list
[email protected]
http://groups.google.com/group/v8-dev
---
You received this message because you are subscribed to the Google Groups "v8-dev" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
For more options, visit https://groups.google.com/d/optout.
