Revision: 24514
Author: [email protected]
Date: Fri Oct 10 08:10:29 2014 UTC
Log: [turbofan] Fix typed lowering of typed array loads/stores.
[email protected]
Review URL: https://codereview.chromium.org/646483003
https://code.google.com/p/v8/source/detail?r=24514
Modified:
/branches/bleeding_edge/src/compiler/js-typed-lowering.cc
/branches/bleeding_edge/src/factory.cc
=======================================
--- /branches/bleeding_edge/src/compiler/js-typed-lowering.cc Wed Oct 8
11:16:45 2014 UTC
+++ /branches/bleeding_edge/src/compiler/js-typed-lowering.cc Fri Oct 10
08:10:29 2014 UTC
@@ -541,21 +541,24 @@
Handle<JSTypedArray>::cast(base_type->AsConstant()->Value());
if (IsExternalArrayElementsKind(array->map()->elements_kind())) {
ExternalArrayType type = array->type();
- uint32_t length;
- CHECK(array->length()->ToUint32(&length));
- Node* elements = graph()->NewNode(
- simplified()->LoadField(AccessBuilder::ForJSObjectElements()),
base,
- graph()->start());
- Node* pointer = graph()->NewNode(
-
simplified()->LoadField(AccessBuilder::ForExternalArrayPointer()),
- elements, elements);
- Node* effect = NodeProperties::GetEffectInput(node);
- Node* control = NodeProperties::GetControlInput(node);
- Node* load = graph()->NewNode(
- simplified()->LoadElement(
- AccessBuilder::ForTypedArrayElement(type, true)),
- pointer, key, jsgraph()->Uint32Constant(length), effect,
control);
- return ReplaceEagerly(node, load);
+ uint32_t byte_length;
+ if (array->byte_length()->ToUint32(&byte_length)) {
+ Node* elements = graph()->NewNode(
+ simplified()->LoadField(AccessBuilder::ForJSObjectElements()),
base,
+ graph()->start());
+ Node* pointer = graph()->NewNode(
+
simplified()->LoadField(AccessBuilder::ForExternalArrayPointer()),
+ elements, elements);
+ Node* length = jsgraph()->Uint32Constant(
+ static_cast<uint32_t>(byte_length / array->element_size()));
+ Node* effect = NodeProperties::GetEffectInput(node);
+ Node* control = NodeProperties::GetControlInput(node);
+ Node* load = graph()->NewNode(
+ simplified()->LoadElement(
+ AccessBuilder::ForTypedArrayElement(type, true)),
+ pointer, key, length, effect, control);
+ return ReplaceEagerly(node, load);
+ }
}
}
return NoChange();
@@ -577,22 +580,24 @@
Handle<JSTypedArray>::cast(base_type->AsConstant()->Value());
if (IsExternalArrayElementsKind(array->map()->elements_kind())) {
ExternalArrayType type = array->type();
- uint32_t length;
- CHECK(array->length()->ToUint32(&length));
- Node* elements = graph()->NewNode(
- simplified()->LoadField(AccessBuilder::ForJSObjectElements()),
base,
- graph()->start());
- Node* pointer = graph()->NewNode(
-
simplified()->LoadField(AccessBuilder::ForExternalArrayPointer()),
- elements, elements);
- Node* effect = NodeProperties::GetEffectInput(node);
- Node* control = NodeProperties::GetControlInput(node);
- Node* store =
- graph()->NewNode(simplified()->StoreElement(
- AccessBuilder::ForTypedArrayElement(type,
true)),
- pointer, key, jsgraph()->Uint32Constant(length),
- value, effect, control);
- return ReplaceEagerly(node, store);
+ uint32_t byte_length;
+ if (array->byte_length()->ToUint32(&byte_length)) {
+ Node* elements = graph()->NewNode(
+ simplified()->LoadField(AccessBuilder::ForJSObjectElements()),
base,
+ graph()->start());
+ Node* pointer = graph()->NewNode(
+
simplified()->LoadField(AccessBuilder::ForExternalArrayPointer()),
+ elements, elements);
+ Node* length = jsgraph()->Uint32Constant(
+ static_cast<uint32_t>(byte_length / array->element_size()));
+ Node* effect = NodeProperties::GetEffectInput(node);
+ Node* control = NodeProperties::GetControlInput(node);
+ Node* store = graph()->NewNode(
+ simplified()->StoreElement(
+ AccessBuilder::ForTypedArrayElement(type, true)),
+ pointer, key, length, value, effect, control);
+ return ReplaceEagerly(node, store);
+ }
}
}
return NoChange();
=======================================
--- /branches/bleeding_edge/src/factory.cc Tue Oct 7 07:36:21 2014 UTC
+++ /branches/bleeding_edge/src/factory.cc Fri Oct 10 08:10:29 2014 UTC
@@ -1729,6 +1729,19 @@
return FIRST_EXTERNAL_ARRAY_ELEMENTS_KIND;
#undef TYPED_ARRAY_CASE
}
+
+
+size_t GetExternalArrayElementSize(ExternalArrayType type) {
+ switch (type) {
+#define TYPED_ARRAY_CASE(Type, type, TYPE, ctype, size) \
+ case kExternal##Type##Array: \
+ return size;
+ TYPED_ARRAYS(TYPED_ARRAY_CASE)
+ }
+ UNREACHABLE();
+ return 0;
+#undef TYPED_ARRAY_CASE
+}
JSFunction* GetTypedArrayFun(ExternalArrayType type, Isolate* isolate) {
@@ -1769,7 +1782,9 @@
array->set_weak_next(buffer->weak_first_view());
buffer->set_weak_first_view(*array);
array->set_byte_offset(Smi::FromInt(0));
- array->set_byte_length(buffer->byte_length());
+ Handle<Object> byte_length_handle =
+ NewNumberFromSize(length * GetExternalArrayElementSize(type));
+ array->set_byte_length(*byte_length_handle);
Handle<Object> length_handle = NewNumberFromSize(length);
array->set_length(*length_handle);
Handle<ExternalArray> elements =
--
--
v8-dev mailing list
[email protected]
http://groups.google.com/group/v8-dev
---
You received this message because you are subscribed to the Google Groups "v8-dev" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
For more options, visit https://groups.google.com/d/optout.
