Reviewers: jarin,
Description:
[turbofan] Fix handling of OsrLoopEntry in ControlReducer::ConnectNTL()
[email protected]
LOG=Y
BUG=chromium:485908
Please review this at https://codereview.chromium.org/1138463004/
Base URL: https://chromium.googlesource.com/v8/v8.git@master
Affected files (+35, -7 lines):
M src/compiler/control-reducer.cc
A test/mjsunit/regress/regress-469605b.js
Index: src/compiler/control-reducer.cc
diff --git a/src/compiler/control-reducer.cc
b/src/compiler/control-reducer.cc
index
6f7ffb3da38481fa9a896cf1e190638737b241d9..6910e6c043b61b7e0e7499fff520b8c9d4d6933d
100644
--- a/src/compiler/control-reducer.cc
+++ b/src/compiler/control-reducer.cc
@@ -90,11 +90,10 @@ class ControlReducerImpl final : public AdvancedReducer
{
bool pop = true;
while (fw_stack.back().second != node->use_edges().end()) {
Edge edge = *(fw_stack.back().second);
+ Node* succ = edge.from();
if (NodeProperties::IsControlEdge(edge) &&
- edge.from()->op()->ControlOutputCount() > 0) {
+ succ->op()->ControlOutputCount() > 0) {
// Only walk control edges to control nodes.
- Node* succ = edge.from();
-
if (marked.IsOnStack(succ) && !marked.IsReachableFromEnd(succ)) {
// {succ} is on stack and not reachable from end.
Node* added = ConnectNTL(succ);
@@ -112,11 +111,14 @@ class ControlReducerImpl final : public
AdvancedReducer {
}
if (!marked.IsReachableFromStart(succ)) {
// {succ} is not yet reached from start.
- marked.Push(succ);
marked.SetReachableFromStart(succ);
- fw_stack.push_back(FwIter(succ, succ->use_edges().begin()));
- pop = false; // "recurse" into successor control node.
- break;
+ if (succ->opcode() != IrOpcode::kOsrLoopEntry) {
+ // Skip OsrLoopEntry; forms a confusing irredducible loop.
+ marked.Push(succ);
+ fw_stack.push_back(FwIter(succ, succ->use_edges().begin()));
+ pop = false; // "recurse" into successor control node.
+ break;
+ }
}
}
++fw_stack.back().second;
Index: test/mjsunit/regress/regress-469605b.js
diff --git a/test/mjsunit/regress/regress-469605b.js
b/test/mjsunit/regress/regress-469605b.js
new file mode 100644
index
0000000000000000000000000000000000000000..de1767617353e88c000a0aa08497a7f5da227556
--- /dev/null
+++ b/test/mjsunit/regress/regress-469605b.js
@@ -0,0 +1,26 @@
+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+function counter() {
+ var i = 10000;
+ return function() {
+ if (i-- > 0) return i;
+ throw "done";
+ }
+}
+
+
+var f = (function() {
+ "use asm";
+ return function f(i, c1, c2) {
+ i = i|0;
+ do {
+ if (i > 0) { while (0 ? this : this) { c1(); } }
+ else c2();
+ } while (true);
+ }
+})();
+
+assertThrows(function() { f(0, counter(), counter()); });
+assertThrows(function() { f(1, counter(), counter()); });
--
--
v8-dev mailing list
[email protected]
http://groups.google.com/group/v8-dev
---
You received this message because you are subscribed to the Google Groups "v8-dev" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
For more options, visit https://groups.google.com/d/optout.
