Reviewers: Jakob,

Message:
Could you take a look, please?

Description:
Infer HConstant::NotInNewSpace only if the supplied handle is null.

BUG=chromium:449291
LOG=n
[email protected]

Please review this at https://codereview.chromium.org/898753003/

Base URL: https://chromium.googlesource.com/v8/v8.git@master

Affected files (+9, -13 lines):
  M src/hydrogen-instructions.cc
  A + test/mjsunit/regress/regress-449291.js


Index: src/hydrogen-instructions.cc
diff --git a/src/hydrogen-instructions.cc b/src/hydrogen-instructions.cc
index bdcdc22890a8f80a28ef33e7640c1b52db6eb9af..ef454e2c4e4604310f861683e0a9cfaea04d9656 100644
--- a/src/hydrogen-instructions.cc
+++ b/src/hydrogen-instructions.cc
@@ -2869,7 +2869,7 @@ void HConstant::Initialize(Representation r) {
     // could cause heap object checks not to get emitted.
     object_ = Unique<Object>(Handle<Object>::null());
   }
-  if (r.IsSmiOrInteger32()) {
+  if (r.IsSmiOrInteger32() && object_.handle().is_null()) {
     // If it's not a heap object, it can't be in new space.
     bit_field_ = IsNotInNewSpaceField::update(bit_field_, true);
   }
Index: test/mjsunit/regress/regress-449291.js
diff --git a/test/mjsunit/array-push12.js b/test/mjsunit/regress/regress-449291.js
similarity index 67%
copy from test/mjsunit/array-push12.js
copy to test/mjsunit/regress/regress-449291.js
index f4c15b484b41197c9007113ecf8f91fe909cc5d3..fb56027b67f3f176f1432c11b39075aec6cc8429 100644
--- a/test/mjsunit/array-push12.js
+++ b/test/mjsunit/regress/regress-449291.js
@@ -4,20 +4,16 @@

 // Flags: --allow-natives-syntax

-var a = [];
-for (var i = -20; i < 0; ++i) {
-  a[i] = 0;
-}
-
-function g() {
-    [].push.apply(a, arguments);
-}
+a = {y:1.5};
+a.y = 1093445778;
+b = a.y;
+c = {y:{}};

 function f() {
-  g();
+  return {y: b};
 }

-g();
-g();
-%OptimizeFunctionOnNextCall(f);
 f();
+f();
+%OptimizeFunctionOnNextCall(f);
+assertEquals(f().y, 1093445778);


--
--
v8-dev mailing list
[email protected]
http://groups.google.com/group/v8-dev
--- You received this message because you are subscribed to the Google Groups "v8-dev" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to [email protected].
For more options, visit https://groups.google.com/d/optout.

Reply via email to