Revision: 8774
Author: [email protected]
Date: Tue Aug 2 02:32:28 2011
Log: Check for phi-uses of arguments object before eliminating dead
phi's.
HGraphBuilder::TryArgumentsAccess does not emit any uses for receiver and
will generate incorrect code when receiver for a property access is defined
by a phi that returns either arguments object or something else.
BUG=v8:1582
TEST=test/mjsunit/regress/regress-1582.js
Review URL: http://codereview.chromium.org/7553006
http://code.google.com/p/v8/source/detail?r=8774
Added:
/branches/bleeding_edge/test/mjsunit/regress/regress-1582.js
Modified:
/branches/bleeding_edge/src/hydrogen.cc
/branches/bleeding_edge/src/hydrogen.h
=======================================
--- /dev/null
+++ /branches/bleeding_edge/test/mjsunit/regress/regress-1582.js Tue Aug 2
02:32:28 2011
@@ -0,0 +1,47 @@
+// Copyright 2011 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --allow-natives-syntax
+
+function f(restIsArray, rest) {
+ var arr;
+ if (typeof rest === "object" && (rest instanceof Array)) {
+ arr = rest;
+ } else {
+ arr = arguments;
+ }
+ var i = arr.length;
+ while (--i >= 0) arr[i];
+ var arrIsArguments = (arr[1] !== rest);
+ assertEquals(restIsArray, arrIsArguments);
+}
+
+f(false, 'b', 'c');
+f(false, 'b', 'c');
+f(false, 'b', 'c');
+%OptimizeFunctionOnNextCall(f);
+f(true, ['b', 'c']);
=======================================
--- /branches/bleeding_edge/src/hydrogen.cc Tue Jul 26 03:24:14 2011
+++ /branches/bleeding_edge/src/hydrogen.cc Tue Aug 2 02:32:28 2011
@@ -838,6 +838,19 @@
}
}
}
+
+
+bool HGraph::CheckPhis() {
+ int block_count = blocks_.length();
+ for (int i = 0; i < block_count; ++i) {
+ for (int j = 0; j < blocks_[i]->phis()->length(); ++j) {
+ HPhi* phi = blocks_[i]->phis()->at(j);
+ // We don't support phi uses of arguments for now.
+ if (phi->CheckFlag(HValue::kIsArguments)) return false;
+ }
+ }
+ return true;
+}
bool HGraph::CollectPhis() {
@@ -847,8 +860,6 @@
for (int j = 0; j < blocks_[i]->phis()->length(); ++j) {
HPhi* phi = blocks_[i]->phis()->at(j);
phi_list_->Add(phi);
- // We don't support phi uses of arguments for now.
- if (phi->CheckFlag(HValue::kIsArguments)) return false;
// Check for the hole value (from an uninitialized const).
for (int k = 0; k < phi->OperandCount(); k++) {
if (phi->OperandAt(k) == GetConstantHole()) return false;
@@ -2300,10 +2311,14 @@
graph()->OrderBlocks();
graph()->AssignDominators();
graph()->PropagateDeoptimizingMark();
+ if (!graph()->CheckPhis()) {
+ Bailout("Unsupported phi use of arguments object");
+ return NULL;
+ }
graph()->EliminateRedundantPhis();
if (FLAG_eliminate_dead_phis) graph()->EliminateUnreachablePhis();
if (!graph()->CollectPhis()) {
- Bailout("Unsupported phi-use");
+ Bailout("Unsupported phi use of uninitialized constant");
return NULL;
}
=======================================
--- /branches/bleeding_edge/src/hydrogen.h Tue Jul 26 03:12:37 2011
+++ /branches/bleeding_edge/src/hydrogen.h Tue Aug 2 02:32:28 2011
@@ -242,6 +242,10 @@
// Returns false if there are phi-uses of the arguments-object
// which are not supported by the optimizing compiler.
+ bool CheckPhis();
+
+ // Returns false if there are phi-uses of hole values comming
+ // from uninitialized consts.
bool CollectPhis();
Handle<Code> Compile(CompilationInfo* info);
--
v8-dev mailing list
[email protected]
http://groups.google.com/group/v8-dev
