Reviewers: Michael Starzinger,
Message:
Could you take a look, please?
Description:
Fix deoptimization of the count operation in Turbofan.
BUG=
Please review this at https://codereview.chromium.org/558663002/
SVN Base: https://v8.googlecode.com/svn/branches/bleeding_edge
Affected files (+7, -1 lines):
M src/compiler/ast-graph-builder.cc
M test/mjsunit/regress/poly_count_operation.js
Index: src/compiler/ast-graph-builder.cc
diff --git a/src/compiler/ast-graph-builder.cc
b/src/compiler/ast-graph-builder.cc
index
5ee9fa457d988447af2e40f55cc02fc09f27639d..584b2361e7a84c2b9b9ab12414bde414c3d4425a
100644
--- a/src/compiler/ast-graph-builder.cc
+++ b/src/compiler/ast-graph-builder.cc
@@ -1420,8 +1420,10 @@ void
AstGraphBuilder::VisitCountOperation(CountOperation* expr) {
switch (assign_type) {
case VARIABLE: {
Variable* variable = expr->expression()->AsVariableProxy()->var();
+ environment()->Push(value);
BuildVariableAssignment(variable, value, expr->op(),
expr->AssignmentId());
+ environment()->Pop();
break;
}
case NAMED_PROPERTY: {
@@ -1430,7 +1432,9 @@ void
AstGraphBuilder::VisitCountOperation(CountOperation* expr) {
MakeUnique(property->key()->AsLiteral()->AsPropertyName());
Node* store =
NewNode(javascript()->StoreNamed(strict_mode(), name), object,
value);
+ environment()->Push(value);
PrepareFrameState(store, expr->AssignmentId());
+ environment()->Pop();
break;
}
case KEYED_PROPERTY: {
@@ -1438,7 +1442,9 @@ void
AstGraphBuilder::VisitCountOperation(CountOperation* expr) {
Node* object = environment()->Pop();
Node* store = NewNode(javascript()->StoreProperty(strict_mode()),
object,
key, value);
+ environment()->Push(value);
PrepareFrameState(store, expr->AssignmentId());
+ environment()->Pop();
break;
}
}
Index: test/mjsunit/regress/poly_count_operation.js
diff --git a/test/mjsunit/regress/poly_count_operation.js
b/test/mjsunit/regress/poly_count_operation.js
index
a8a1ed2ebc3242b1ed3e0b726978e1e1a3082241..99f041b6f1765047e05442d532bf9d650c6c8d68
100644
--- a/test/mjsunit/regress/poly_count_operation.js
+++ b/test/mjsunit/regress/poly_count_operation.js
@@ -25,7 +25,7 @@
// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
-// Flags: --allow-natives-syntax
+// Flags: --allow-natives-syntax --turbo-deoptimization
var o1 = {x:1};
var o2 = {};
--
--
v8-dev mailing list
[email protected]
http://groups.google.com/group/v8-dev
---
You received this message because you are subscribed to the Google Groups "v8-dev" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
For more options, visit https://groups.google.com/d/optout.
