Reviewers: Jakob,
Description:
Version 4.2.77.9 (cherry-pick)
Merged ddfca2b06992b3f82dfdc89e468ddc518f18396a
Bugfix in hydrogen GVN.
BUG=chromium:467481
LOG=N
[email protected]
Please review this at https://codereview.chromium.org/1020473006/
Base URL: https://chromium.googlesource.com/v8/[email protected]
Affected files (+15, -19 lines):
M include/v8-version.h
M src/hydrogen.cc
A + test/mjsunit/regress/regress-467481.js
Index: include/v8-version.h
diff --git a/include/v8-version.h b/include/v8-version.h
index
1aa052e640c7dfdd507c42259da5d4acbb4a12be..b8eb8b117146ac58ff4f60627aa603b0a31c0d1c
100644
--- a/include/v8-version.h
+++ b/include/v8-version.h
@@ -11,7 +11,7 @@
#define V8_MAJOR_VERSION 4
#define V8_MINOR_VERSION 2
#define V8_BUILD_NUMBER 77
-#define V8_PATCH_LEVEL 8
+#define V8_PATCH_LEVEL 9
// Use 1 for candidates and 0 otherwise.
// (Boolean macro values are not supported by all preprocessors.)
Index: src/hydrogen.cc
diff --git a/src/hydrogen.cc b/src/hydrogen.cc
index
50e3b2124df60ddc29331f0d9d4feb8f753c6a54..d73a3ebac46bbec420eab87db222f27c78f9f426
100644
--- a/src/hydrogen.cc
+++ b/src/hydrogen.cc
@@ -6905,9 +6905,6 @@ HInstruction*
HOptimizedGraphBuilder::BuildMonomorphicElementAccess(
PropertyAccessType access_type,
KeyedAccessStoreMode store_mode) {
HCheckMaps* checked_object = Add<HCheckMaps>(object, map, dependency);
- if (dependency) {
- checked_object->ClearDependsOnFlag(kElementsKind);
- }
if (access_type == STORE && map->prototype()->IsJSObject()) {
// monomorphic stores need a prototype chain check because shape
Index: test/mjsunit/regress/regress-467481.js
diff --git a/test/mjsunit/array-push12.js
b/test/mjsunit/regress/regress-467481.js
similarity index 52%
copy from test/mjsunit/array-push12.js
copy to test/mjsunit/regress/regress-467481.js
index
f4c15b484b41197c9007113ecf8f91fe909cc5d3..dcb12d89b0b0c857c28fdd55ff941a9bfcadf941
100644
--- a/test/mjsunit/array-push12.js
+++ b/test/mjsunit/regress/regress-467481.js
@@ -4,20 +4,19 @@
// Flags: --allow-natives-syntax
-var a = [];
-for (var i = -20; i < 0; ++i) {
- a[i] = 0;
+function f(a1, a2) {
+ var v7 = a2[0];
+ var v8 = a1[0];
+ a2[0] = 0.3;
}
-
-function g() {
- [].push.apply(a, arguments);
-}
-
-function f() {
- g();
-}
-
-g();
-g();
+v6 = new Array(1);
+v6[0] = "tagged";
+f(v6, [1]);
+v5 = new Array(1);
+v5[0] = 0.1;
+f(v5, v5);
+v5 = new Array(10);
+f(v5, v5);
%OptimizeFunctionOnNextCall(f);
-f();
+f(v5, v5);
+v5[0];
--
--
v8-dev mailing list
[email protected]
http://groups.google.com/group/v8-dev
---
You received this message because you are subscribed to the Google Groups "v8-dev" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
For more options, visit https://groups.google.com/d/optout.
