Reviewers: Michael Starzinger,
Description:
[turbofan] Fix cycles introduced by pushing ToNumbers into phis.
TEST=cctest
[email protected]
Please review this at https://codereview.chromium.org/790123002/
Base URL: https://chromium.googlesource.com/v8/v8.git@master
Affected files (+42, -35 lines):
M src/compiler/js-generic-lowering.h
M src/compiler/js-generic-lowering.cc
M src/compiler/js-typed-lowering.cc
M src/types.h
M test/cctest/cctest.status
Index: src/compiler/js-generic-lowering.cc
diff --git a/src/compiler/js-generic-lowering.cc
b/src/compiler/js-generic-lowering.cc
index
48864423146007ec632915d4ac1ad0658ca80c93..3275256a2811b24743fb89de19a1889aeba470b5
100644
--- a/src/compiler/js-generic-lowering.cc
+++ b/src/compiler/js-generic-lowering.cc
@@ -232,6 +232,12 @@ void JSGenericLowering::LowerJSToBoolean(Node* node) {
void JSGenericLowering::LowerJSToNumber(Node* node) {
Callable callable = CodeFactory::ToNumber(isolate());
+ // TODO(mstarzinger): Embedding the context this way prevents sharing of
code
+ // across native contexts.
+ if (!info_context_constant_.is_set()) {
+ info_context_constant_.set(jsgraph()->HeapConstant(info()->context()));
+ }
+ node->ReplaceInput(1, info_context_constant_.get());
ReplaceWithStubCall(node, callable, FlagsForNode(node));
}
Index: src/compiler/js-generic-lowering.h
diff --git a/src/compiler/js-generic-lowering.h
b/src/compiler/js-generic-lowering.h
index
eb234b84ff3a94fa27b5aa4c4b9255cd4ed3bc27..c3049883cd67be9cf50b12669e91135657b28734
100644
--- a/src/compiler/js-generic-lowering.h
+++ b/src/compiler/js-generic-lowering.h
@@ -60,6 +60,7 @@ class JSGenericLowering : public Reducer {
private:
CompilationInfo* info_;
+ SetOncePointer<Node> info_context_constant_;
JSGraph* jsgraph_;
Linkage* linkage_;
};
Index: src/compiler/js-typed-lowering.cc
diff --git a/src/compiler/js-typed-lowering.cc
b/src/compiler/js-typed-lowering.cc
index
9de549362166853612c6b458293d0b2f122f3236..69bc255ce8b2363f00f2914f7d062b6bdae2001d
100644
--- a/src/compiler/js-typed-lowering.cc
+++ b/src/compiler/js-typed-lowering.cc
@@ -528,41 +528,44 @@ Reduction JSTypedLowering::ReduceJSToNumber(Node*
node) {
return reduction;
}
Type* const input_type = NodeProperties::GetBounds(input).upper;
- if (input->opcode() == IrOpcode::kPhi &&
input_type->Is(Type::Primitive())) {
- Node* const context = node->InputAt(1);
- // JSToNumber(phi(x1,...,xn,control):primitive)
- // => phi(JSToNumber(x1),...,JSToNumber(xn),control):number
+ if (input_type->Is(Type::PlainPrimitive())) {
+ // Converting a plain primitive to a number has no observable side
effects.
RelaxEffects(node);
- int const input_count = input->InputCount() - 1;
- Node* const control = input->InputAt(input_count);
- DCHECK_LE(0, input_count);
- DCHECK(NodeProperties::IsControl(control));
- DCHECK(NodeProperties::GetBounds(node).upper->Is(Type::Number()));
- DCHECK(!NodeProperties::GetBounds(input).upper->Is(Type::Number()));
- node->set_op(common()->Phi(kMachAnyTagged, input_count));
- for (int i = 0; i < input_count; ++i) {
- Node* value = input->InputAt(i);
- // Recursively try to reduce the value first.
- Reduction reduction = ReduceJSToNumberInput(value);
- if (reduction.Changed()) {
- value = reduction.replacement();
- } else {
- value = graph()->NewNode(javascript()->ToNumber(), value, context,
- graph()->start(), graph()->start());
+ // JSToNumber(phi(x1,...,xn,control):plain-primitive,context)
+ // =>
phi(JSToNumber(x1,no-context),...,JSToNumber(xn,no-context),control)
+ if (input->opcode() == IrOpcode::kPhi) {
+ int const input_count = input->InputCount() - 1;
+ Node* const control = input->InputAt(input_count);
+ DCHECK_LE(0, input_count);
+ DCHECK(NodeProperties::IsControl(control));
+ DCHECK(NodeProperties::GetBounds(node).upper->Is(Type::Number()));
+ DCHECK(!NodeProperties::GetBounds(input).upper->Is(Type::Number()));
+ node->set_op(common()->Phi(kMachAnyTagged, input_count));
+ for (int i = 0; i < input_count; ++i) {
+ Node* value = input->InputAt(i);
+ // Recursively try to reduce the value first.
+ Reduction reduction = ReduceJSToNumberInput(value);
+ if (reduction.Changed()) {
+ value = reduction.replacement();
+ } else {
+ value = graph()->NewNode(javascript()->ToNumber(), value,
+ jsgraph()->NoContextConstant(),
+ graph()->start(), graph()->start());
+ }
+ if (i < node->InputCount()) {
+ node->ReplaceInput(i, value);
+ } else {
+ node->AppendInput(graph()->zone(), value);
+ }
}
- if (i < node->InputCount()) {
- node->ReplaceInput(i, value);
+ if (input_count < node->InputCount()) {
+ node->ReplaceInput(input_count, control);
} else {
- node->AppendInput(graph()->zone(), value);
+ node->AppendInput(graph()->zone(), control);
}
+ node->TrimInputCount(input_count + 1);
+ return Changed(node);
}
- if (input_count < node->InputCount()) {
- node->ReplaceInput(input_count, control);
- } else {
- node->AppendInput(graph()->zone(), control);
- }
- node->TrimInputCount(input_count + 1);
- return Changed(node);
}
return NoChange();
}
Index: src/types.h
diff --git a/src/types.h b/src/types.h
index
f810b3940f0f08400cf2dc4a574aa9342d7b6d2a..0f21073de103aa323401bf3b150f687d4ce6edfa
100644
--- a/src/types.h
+++ b/src/types.h
@@ -213,7 +213,8 @@ namespace internal {
V(UniqueName, kSymbol | kInternalizedString) \
V(Name, kSymbol | kString) \
V(NumberOrString, kNumber | kString) \
- V(Primitive, kNumber | kName | kBoolean | kNull | kUndefined) \
+ V(PlainPrimitive, kNumberOrString | kBoolean | kNull | kUndefined) \
+ V(Primitive, kSymbol | kPlainPrimitive) \
V(DetectableObject, kArray | kFunction | kRegExp | kOtherObject) \
V(DetectableReceiver, kDetectableObject | kProxy) \
V(Detectable, kDetectableReceiver | kNumber | kName) \
Index: test/cctest/cctest.status
diff --git a/test/cctest/cctest.status b/test/cctest/cctest.status
index
374c3bc28cb5ccb46eaa02fc75e9c761888197bc..cc5414da27364e4955eaf8abd8f48de8f65121a3
100644
--- a/test/cctest/cctest.status
+++ b/test/cctest/cctest.status
@@ -114,10 +114,6 @@
'test-debug/NoDebugBreakInAfterCompileMessageHandler': [PASS,
NO_VARIANTS],
'test-debug/RegExpDebugBreak': [PASS, NO_VARIANTS],
- # TODO(mstarzinger): Investigate these failures.
- 'test-run-inlining/InlineTwiceDependentDiamond': [SKIP],
- 'test-run-inlining/InlineTwiceDependentDiamondDifferent': [SKIP],
-
# TODO(titzer): Triggers bug in late control reduction.
'test-run-inlining/InlineLoopGuardedEmpty': [SKIP],
--
--
v8-dev mailing list
[email protected]
http://groups.google.com/group/v8-dev
---
You received this message because you are subscribed to the Google Groups "v8-dev" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
For more options, visit https://groups.google.com/d/optout.
