Reviewers: Benedikt Meurer,
Message:
Could you take a look, please?
Description:
[turbofan] Fix the deopt ids in assignment.
BUG=chromium:463028
LOG=n
[email protected]
Please review this at https://codereview.chromium.org/987733003/
Base URL: https://chromium.googlesource.com/v8/v8.git@master
Affected files (+12, -15 lines):
M src/compiler/ast-graph-builder.cc
A + test/mjsunit/regress/regress-463028.js
Index: src/compiler/ast-graph-builder.cc
diff --git a/src/compiler/ast-graph-builder.cc
b/src/compiler/ast-graph-builder.cc
index
c2e7bc849d704bb430fce95ce5e45a1f38c9fa1a..e87ca786b19775e1dac0d88e370b1ac7d75bb6f1
100644
--- a/src/compiler/ast-graph-builder.cc
+++ b/src/compiler/ast-graph-builder.cc
@@ -1844,7 +1844,7 @@ void AstGraphBuilder::VisitAssignment(Assignment*
expr) {
switch (assign_type) {
case VARIABLE: {
Variable* variable = expr->target()->AsVariableProxy()->var();
- BuildVariableAssignment(variable, value, expr->op(),
expr->AssignmentId(),
+ BuildVariableAssignment(variable, value, expr->op(), expr->id(),
ast_context()->GetStateCombine());
break;
}
@@ -1854,8 +1854,7 @@ void AstGraphBuilder::VisitAssignment(Assignment*
expr) {
MakeUnique(property->key()->AsLiteral()->AsPropertyName());
Node* store = NewNode(javascript()->StoreNamed(language_mode(),
name),
object, value);
- PrepareFrameState(store, expr->AssignmentId(),
- ast_context()->GetStateCombine());
+ PrepareFrameState(store, expr->id(),
ast_context()->GetStateCombine());
break;
}
case KEYED_PROPERTY: {
@@ -1863,8 +1862,7 @@ void AstGraphBuilder::VisitAssignment(Assignment*
expr) {
Node* object = environment()->Pop();
Node* store = NewNode(javascript()->StoreProperty(language_mode()),
object, key, value);
- PrepareFrameState(store, expr->AssignmentId(),
- ast_context()->GetStateCombine());
+ PrepareFrameState(store, expr->id(),
ast_context()->GetStateCombine());
break;
}
}
Index: test/mjsunit/regress/regress-463028.js
diff --git a/test/mjsunit/regress/regress-449291.js
b/test/mjsunit/regress/regress-463028.js
similarity index 56%
copy from test/mjsunit/regress/regress-449291.js
copy to test/mjsunit/regress/regress-463028.js
index
fb56027b67f3f176f1432c11b39075aec6cc8429..1454ef1aea9a4ba296f99ce0531821e3ccd85aa5
100644
--- a/test/mjsunit/regress/regress-449291.js
+++ b/test/mjsunit/regress/regress-463028.js
@@ -4,16 +4,15 @@
// Flags: --allow-natives-syntax
-a = {y:1.5};
-a.y = 1093445778;
-b = a.y;
-c = {y:{}};
+var o = {}
+Object.defineProperty(o, "z", {
+ set: function() {
+ %DeoptimizeFunction(f);
+ },
+});
-function f() {
- return {y: b};
+function f(o) {
+ return 19 + (void(o.z = 12));
}
-f();
-f();
-%OptimizeFunctionOnNextCall(f);
-assertEquals(f().y, 1093445778);
+f(o);
--
--
v8-dev mailing list
[email protected]
http://groups.google.com/group/v8-dev
---
You received this message because you are subscribed to the Google Groups "v8-dev" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
For more options, visit https://groups.google.com/d/optout.
