Reviewers: jarin,
Description:
[turbofan] Fix typed lowering of typed array loads/stores.
[email protected]
Please review this at https://codereview.chromium.org/646483003/
SVN Base: https://v8.googlecode.com/svn/branches/bleeding_edge
Affected files (+52, -32 lines):
M src/compiler/js-typed-lowering.cc
M src/factory.cc
Index: src/compiler/js-typed-lowering.cc
diff --git a/src/compiler/js-typed-lowering.cc
b/src/compiler/js-typed-lowering.cc
index
05e8ede0fd3d33d59eb3bfe8c0ba0ef86becfc58..8446b3d6df0531b634a8869b4687faa7f7724508
100644
--- a/src/compiler/js-typed-lowering.cc
+++ b/src/compiler/js-typed-lowering.cc
@@ -541,21 +541,24 @@ Reduction JSTypedLowering::ReduceJSLoadProperty(Node*
node) {
Handle<JSTypedArray>::cast(base_type->AsConstant()->Value());
if (IsExternalArrayElementsKind(array->map()->elements_kind())) {
ExternalArrayType type = array->type();
- uint32_t length;
- CHECK(array->length()->ToUint32(&length));
- Node* elements = graph()->NewNode(
- simplified()->LoadField(AccessBuilder::ForJSObjectElements()),
base,
- graph()->start());
- Node* pointer = graph()->NewNode(
-
simplified()->LoadField(AccessBuilder::ForExternalArrayPointer()),
- elements, elements);
- Node* effect = NodeProperties::GetEffectInput(node);
- Node* control = NodeProperties::GetControlInput(node);
- Node* load = graph()->NewNode(
- simplified()->LoadElement(
- AccessBuilder::ForTypedArrayElement(type, true)),
- pointer, key, jsgraph()->Uint32Constant(length), effect,
control);
- return ReplaceEagerly(node, load);
+ uint32_t byte_length;
+ if (array->byte_length()->ToUint32(&byte_length)) {
+ Node* elements = graph()->NewNode(
+ simplified()->LoadField(AccessBuilder::ForJSObjectElements()),
base,
+ graph()->start());
+ Node* pointer = graph()->NewNode(
+
simplified()->LoadField(AccessBuilder::ForExternalArrayPointer()),
+ elements, elements);
+ Node* length =
+ jsgraph()->Uint32Constant(byte_length / array->element_size());
+ Node* effect = NodeProperties::GetEffectInput(node);
+ Node* control = NodeProperties::GetControlInput(node);
+ Node* load = graph()->NewNode(
+ simplified()->LoadElement(
+ AccessBuilder::ForTypedArrayElement(type, true)),
+ pointer, key, length, effect, control);
+ return ReplaceEagerly(node, load);
+ }
}
}
return NoChange();
@@ -577,22 +580,24 @@ Reduction
JSTypedLowering::ReduceJSStoreProperty(Node* node) {
Handle<JSTypedArray>::cast(base_type->AsConstant()->Value());
if (IsExternalArrayElementsKind(array->map()->elements_kind())) {
ExternalArrayType type = array->type();
- uint32_t length;
- CHECK(array->length()->ToUint32(&length));
- Node* elements = graph()->NewNode(
- simplified()->LoadField(AccessBuilder::ForJSObjectElements()),
base,
- graph()->start());
- Node* pointer = graph()->NewNode(
-
simplified()->LoadField(AccessBuilder::ForExternalArrayPointer()),
- elements, elements);
- Node* effect = NodeProperties::GetEffectInput(node);
- Node* control = NodeProperties::GetControlInput(node);
- Node* store =
- graph()->NewNode(simplified()->StoreElement(
- AccessBuilder::ForTypedArrayElement(type,
true)),
- pointer, key, jsgraph()->Uint32Constant(length),
- value, effect, control);
- return ReplaceEagerly(node, store);
+ uint32_t byte_length;
+ if (array->byte_length()->ToUint32(&byte_length)) {
+ Node* elements = graph()->NewNode(
+ simplified()->LoadField(AccessBuilder::ForJSObjectElements()),
base,
+ graph()->start());
+ Node* pointer = graph()->NewNode(
+
simplified()->LoadField(AccessBuilder::ForExternalArrayPointer()),
+ elements, elements);
+ Node* length =
+ jsgraph()->Uint32Constant(byte_length / array->element_size());
+ Node* effect = NodeProperties::GetEffectInput(node);
+ Node* control = NodeProperties::GetControlInput(node);
+ Node* store = graph()->NewNode(
+ simplified()->StoreElement(
+ AccessBuilder::ForTypedArrayElement(type, true)),
+ pointer, key, length, value, effect, control);
+ return ReplaceEagerly(node, store);
+ }
}
}
return NoChange();
Index: src/factory.cc
diff --git a/src/factory.cc b/src/factory.cc
index
25d8cd80e50c75f4b2eb3a4d72bf6b831058c575..60ea691d916ff071dfec04459bdccd7c34c7b0fd
100644
--- a/src/factory.cc
+++ b/src/factory.cc
@@ -1731,6 +1731,19 @@ ElementsKind
GetExternalArrayElementsKind(ExternalArrayType type) {
}
+size_t GetExternalArrayElementSize(ExternalArrayType type) {
+ switch (type) {
+#define TYPED_ARRAY_CASE(Type, type, TYPE, ctype, size) \
+ case kExternal##Type##Array: \
+ return size;
+ TYPED_ARRAYS(TYPED_ARRAY_CASE)
+ }
+ UNREACHABLE();
+ return 0;
+#undef TYPED_ARRAY_CASE
+}
+
+
JSFunction* GetTypedArrayFun(ExternalArrayType type, Isolate* isolate) {
Context* native_context = isolate->context()->native_context();
switch (type) {
@@ -1769,7 +1782,9 @@ Handle<JSTypedArray>
Factory::NewJSTypedArray(ExternalArrayType type,
array->set_weak_next(buffer->weak_first_view());
buffer->set_weak_first_view(*array);
array->set_byte_offset(Smi::FromInt(0));
- array->set_byte_length(buffer->byte_length());
+ Handle<Object> byte_length_handle =
+ NewNumberFromSize(length * GetExternalArrayElementSize(type));
+ array->set_byte_length(*byte_length_handle);
Handle<Object> length_handle = NewNumberFromSize(length);
array->set_length(*length_handle);
Handle<ExternalArray> elements =
--
--
v8-dev mailing list
[email protected]
http://groups.google.com/group/v8-dev
---
You received this message because you are subscribed to the Google Groups "v8-dev" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
For more options, visit https://groups.google.com/d/optout.
