Reviewers: titzer,
Message:
Could you take a look, please?
Description:
Fix stack layout of full code arm64 for object literal.
BUG=
Please review this at https://codereview.chromium.org/1095203005/
Base URL: https://chromium.googlesource.com/v8/v8.git@master
Affected files (+15, -13 lines):
M src/arm64/full-codegen-arm64.cc
A + test/mjsunit/compiler/lazy-deopt-in-literal.js
Index: src/arm64/full-codegen-arm64.cc
diff --git a/src/arm64/full-codegen-arm64.cc
b/src/arm64/full-codegen-arm64.cc
index
60c6b51580ba88faa702a0aa1d249f7fcc02fc47..805ccf9209d8c111e3d0730061ceeae7948ccf70
100644
--- a/src/arm64/full-codegen-arm64.cc
+++ b/src/arm64/full-codegen-arm64.cc
@@ -1740,19 +1740,17 @@ void
FullCodeGenerator::VisitObjectLiteral(ObjectLiteral* expr) {
}
break;
}
+ __ Peek(x0, 0);
+ __ Push(x0);
+ VisitForStackValue(key);
+ VisitForStackValue(value);
if (property->emit_store()) {
- // Duplicate receiver on stack.
- __ Peek(x0, 0);
- __ Push(x0);
- VisitForStackValue(key);
- VisitForStackValue(value);
EmitSetHomeObjectIfNeeded(value, 2);
__ Mov(x0, Smi::FromInt(SLOPPY)); // Language mode
__ Push(x0);
__ CallRuntime(Runtime::kSetProperty, 4);
} else {
- VisitForEffect(key);
- VisitForEffect(value);
+ __ Drop(3);
}
break;
case ObjectLiteral::Property::PROTOTYPE:
Index: test/mjsunit/compiler/lazy-deopt-in-literal.js
diff --git a/test/mjsunit/compiler/regress-ntl-effect.js
b/test/mjsunit/compiler/lazy-deopt-in-literal.js
similarity index 50%
copy from test/mjsunit/compiler/regress-ntl-effect.js
copy to test/mjsunit/compiler/lazy-deopt-in-literal.js
index
708fe32828c9197dfa3d8c371ab01cbc1ad3317a..0a1481c571a0a8ec20e9ed3ff65bbd7a4f44aece
100644
--- a/test/mjsunit/compiler/regress-ntl-effect.js
+++ b/test/mjsunit/compiler/lazy-deopt-in-literal.js
@@ -4,13 +4,17 @@
// Flags: --allow-natives-syntax
-function g() {
- throw 0;
+function deopt() {
+ %DeoptimizeFunction(fun3);
}
-function f() {
- g();
- while (1) {}
+function fun3() {
+ var r = { 113: deopt(), 113: 7 };
+ return r[113];
}
-assertThrows(function () { f(); });
+fun3();
+fun3();
+%OptimizeFunctionOnNextCall(fun3);
+var y = fun3();
+assertEquals(7, y);
--
--
v8-dev mailing list
[email protected]
http://groups.google.com/group/v8-dev
---
You received this message because you are subscribed to the Google Groups "v8-dev" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
For more options, visit https://groups.google.com/d/optout.
