Reviewers: rossberg,
Message:
Could you take a look, please?
Unfortunately, GetRange is not really monotone, so I removed the test.
The counterexample is Range(1, 2) <= SignedSmall Union Range(1e+10, inf),
but
Range(1, 2) <=/= Range(1e+10, inf).
(This also shows that GetRange is really an ugly hack that we will have to
address in a more principled way.)
Description:
Reland "[turbofan] Weakening of types must weaken ranges inside unions."
This relands commit 4c1f4b796d1c455fc6a023abe145a5e48c4b7b1f.
[email protected]
Please review this at https://codereview.chromium.org/723023002/
Base URL: https://chromium.googlesource.com/v8/v8.git@master
Affected files (+55, -11 lines):
M src/compiler/typer.cc
M src/types.h
M src/types.cc
M test/cctest/test-types.cc
A + test/mjsunit/regress/regress-weakening-multiplication.js
Index: src/compiler/typer.cc
diff --git a/src/compiler/typer.cc b/src/compiler/typer.cc
index
97b43f4aefb989ac69e732a14c3fa77b954920a9..20a39d94493ff1eed1463e1a142d7cd037c90655
100644
--- a/src/compiler/typer.cc
+++ b/src/compiler/typer.cc
@@ -1119,10 +1119,9 @@ Bounds Typer::Visitor::TypeJSLoadNamed(Node* node) {
// in the graph. In the current implementation, we are
// increasing the limits to the closest power of two.
Type* Typer::Visitor::Weaken(Type* current_type, Type* previous_type) {
- if (current_type->IsRange() && previous_type->IsRange()) {
- Type::RangeType* previous = previous_type->AsRange();
- Type::RangeType* current = current_type->AsRange();
-
+ Type::RangeType* previous = previous_type->GetRange();
+ Type::RangeType* current = current_type->GetRange();
+ if (previous != NULL && current != NULL) {
double current_min = current->Min()->Number();
Handle<Object> new_min = current->Min();
@@ -1152,7 +1151,9 @@ Type* Typer::Visitor::Weaken(Type* current_type,
Type* previous_type) {
}
}
- return Type::Range(new_min, new_max, typer_->zone());
+ return Type::Union(current_type,
+ Type::Range(new_min, new_max, typer_->zone()),
+ typer_->zone());
}
return current_type;
}
Index: src/types.cc
diff --git a/src/types.cc b/src/types.cc
index
d595b049d214a158cdb74056b884e1b26bd1e87e..b423beea0833e4be55865ff0e7d9fa463226afc4
100644
--- a/src/types.cc
+++ b/src/types.cc
@@ -2,6 +2,8 @@
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
+#include <iomanip>
+
#include "src/types.h"
#include "src/ostreams.h"
@@ -1017,8 +1019,12 @@ void TypeImpl<Config>::PrintTo(std::ostream& os,
PrintDimension dim) {
} else if (this->IsConstant()) {
os << "Constant(" << Brief(*this->AsConstant()->Value()) << ")";
} else if (this->IsRange()) {
+ std::ostream::fmtflags saved_flags = os.setf(std::ios::fixed);
+ std::streamsize saved_precision = os.precision(0);
os << "Range(" << this->AsRange()->Min()->Number() << ", "
<< this->AsRange()->Max()->Number() << ")";
+ os.flags(saved_flags);
+ os.precision(saved_precision);
} else if (this->IsContext()) {
os << "Context(";
this->AsContext()->Outer()->PrintTo(os, dim);
Index: src/types.h
diff --git a/src/types.h b/src/types.h
index
1d506d0ca2eba3a2fa898ebde2530f20d5e421ee..aafaf07fb5ddc054378ea7a53be68545bb2006ef
100644
--- a/src/types.h
+++ b/src/types.h
@@ -464,6 +464,11 @@ class TypeImpl : public Config::Base {
double Min();
double Max();
+ // Extracts a range from the type. If the type is a range, it just
+ // returns it; if it is a union, it returns the range component.
+ // Note that it does not contain range for constants.
+ RangeType* GetRange();
+
int NumClasses();
int NumConstants();
@@ -551,7 +556,6 @@ class TypeImpl : public Config::Base {
static bool Contains(RangeType* lhs, RangeType* rhs);
static bool Contains(RangeType* range, i::Object* val);
- RangeType* GetRange();
static int UpdateRange(
RangeHandle type, UnionHandle result, int size, Region* region);
Index: test/cctest/test-types.cc
diff --git a/test/cctest/test-types.cc b/test/cctest/test-types.cc
index
e564c6c0808ab20f29d0fde37b12380d55343dcf..6e06890214d79a8fde4c828d06b0b6d4fe827113
100644
--- a/test/cctest/test-types.cc
+++ b/test/cctest/test-types.cc
@@ -1831,6 +1831,32 @@ struct Tests : Rep {
*/
}
+ void GetRange() {
+ // GetRange(Range(a, b)) = Range(a, b).
+ for (TypeIterator it1 = T.types.begin(); it1 != T.types.end(); ++it1) {
+ TypeHandle type1 = *it1;
+ if (type1->IsRange()) {
+ typename Type::RangeType* range = type1->GetRange();
+ CHECK(type1->Min() == range->Min()->Number());
+ CHECK(type1->Max() == range->Max()->Number());
+ }
+ }
+
+ // GetRange(Union(Constant(x), Range(min,max))) == Range(min, max).
+ for (TypeIterator it1 = T.types.begin(); it1 != T.types.end(); ++it1) {
+ for (TypeIterator it2 = T.types.begin(); it2 != T.types.end();
++it2) {
+ TypeHandle type1 = *it1;
+ TypeHandle type2 = *it2;
+ if (type1->IsConstant() && type2->IsRange()) {
+ TypeHandle u = T.Union(type1, type2);
+
+ CHECK(type2->Min() == u->GetRange()->Min()->Number());
+ CHECK(type2->Max() == u->GetRange()->Max()->Number());
+ }
+ }
+ }
+ }
+
template<class Type2, class TypeHandle2, class Region2, class Rep2>
void Convert() {
Types<Type2, TypeHandle2, Region2> T2(
@@ -2030,6 +2056,13 @@ TEST(Distributivity) {
}
+TEST(GetRange) {
+ CcTest::InitializeVM();
+ ZoneTests().GetRange();
+ HeapTests().GetRange();
+}
+
+
TEST(Convert) {
CcTest::InitializeVM();
ZoneTests().Convert<HeapType, Handle<HeapType>, Isolate, HeapRep>();
Index: test/mjsunit/regress/regress-weakening-multiplication.js
diff --git a/test/mjsunit/regress/regress-store-global-proxy.js
b/test/mjsunit/regress/regress-weakening-multiplication.js
similarity index 67%
copy from test/mjsunit/regress/regress-store-global-proxy.js
copy to test/mjsunit/regress/regress-weakening-multiplication.js
index
c85531c5fd917daa67b54e87141a164b90f3729b..dcf00114b7e46dfebb505eaeff57c484663c6fcb
100644
--- a/test/mjsunit/regress/regress-store-global-proxy.js
+++ b/test/mjsunit/regress/regress-weakening-multiplication.js
@@ -2,11 +2,11 @@
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
-delete Object.prototype.__proto__;
-
function f() {
- this.toString = 1;
+ for (var j = 1; j < 1; j *= -8) {
+ }
+ for (var i = 1; i < 1; j += 2) {
+ j * -1;
+ }
}
-
-f.apply({});
f();
--
--
v8-dev mailing list
[email protected]
http://groups.google.com/group/v8-dev
---
You received this message because you are subscribed to the Google Groups "v8-dev" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
For more options, visit https://groups.google.com/d/optout.
