Reviewers: Michael Starzinger,
Message:
Could you take a look, please?
Description:
[turbofan] Fix deoptimization of uint8, uint16 inputs.
BUG=
Please review this at https://codereview.chromium.org/707443003/
Base URL: https://v8.googlecode.com/svn/branches/bleeding_edge
Affected files (+22, -2 lines):
M src/compiler/code-generator.cc
M src/compiler/linkage.cc
A test/mjsunit/compiler/regress-uint8-deopt.js
Index: src/compiler/code-generator.cc
diff --git a/src/compiler/code-generator.cc b/src/compiler/code-generator.cc
index
7ca27ce7596e90326b26bf574a4798ac8ca8bc9e..8f72aed48751d9c4af0a1a93150205aba242afb6
100644
--- a/src/compiler/code-generator.cc
+++ b/src/compiler/code-generator.cc
@@ -424,7 +424,8 @@ void
CodeGenerator::AddTranslationForOperand(Translation* translation,
if (type == kMachBool || type == kMachInt32 || type == kMachInt8 ||
type == kMachInt16) {
translation->StoreInt32StackSlot(op->index());
- } else if (type == kMachUint32) {
+ } else if (type == kMachUint32 || type == kMachUint16 ||
+ type == kMachUint8) {
translation->StoreUint32StackSlot(op->index());
} else if ((type & kRepMask) == kRepTagged) {
translation->StoreStackSlot(op->index());
@@ -439,7 +440,8 @@ void
CodeGenerator::AddTranslationForOperand(Translation* translation,
if (type == kMachBool || type == kMachInt32 || type == kMachInt8 ||
type == kMachInt16) {
translation->StoreInt32Register(converter.ToRegister(op));
- } else if (type == kMachUint32) {
+ } else if (type == kMachUint32 || type == kMachUint16 ||
+ type == kMachUint8) {
translation->StoreUint32Register(converter.ToRegister(op));
} else if ((type & kRepMask) == kRepTagged) {
translation->StoreRegister(converter.ToRegister(op));
Index: src/compiler/linkage.cc
diff --git a/src/compiler/linkage.cc b/src/compiler/linkage.cc
index
a97e484270f08a38dd300ba315f273ba72782f69..16529b403d131ddba7c898e917a2f552a9eb5548
100644
--- a/src/compiler/linkage.cc
+++ b/src/compiler/linkage.cc
@@ -186,6 +186,7 @@ bool Linkage::NeedsFrameState(Runtime::FunctionId
function) {
case Runtime::kRegExpCompile:
case Runtime::kRegExpExecMultiple:
case Runtime::kResolvePossiblyDirectEval:
+ case Runtime::kRunMicrotasks:
case Runtime::kSetPrototype:
case Runtime::kSetScriptBreakPoint:
case Runtime::kSparseJoinWithSeparator:
Index: test/mjsunit/compiler/regress-uint8-deopt.js
diff --git a/test/mjsunit/compiler/regress-uint8-deopt.js
b/test/mjsunit/compiler/regress-uint8-deopt.js
new file mode 100644
index
0000000000000000000000000000000000000000..ba2823fa358e26a33fe9eac49a4b8a23879d6c04
--- /dev/null
+++ b/test/mjsunit/compiler/regress-uint8-deopt.js
@@ -0,0 +1,17 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --turbo-asm --turbo-deoptimization --allow-natives-syntax
+
+function Module(heap) {
+ "use asm";
+ var a = new Uint8Array(heap);
+ function f() {
+ var x = a[0] | 0;
+ %DeoptimizeFunction(f);
+ return x;
+ }
+ return f;
+}
+assertEquals(0, Module(new ArrayBuffer(1))());
--
--
v8-dev mailing list
[email protected]
http://groups.google.com/group/v8-dev
---
You received this message because you are subscribed to the Google Groups "v8-dev" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
For more options, visit https://groups.google.com/d/optout.
