Revision: 12493
Author: [email protected]
Date: Wed Sep 12 10:00:25 2012
Log: Fixed bounds check removal by restricting it to int32 indexes
(and reenabled both ABCR and index dehoisting).
BUG=
TEST=
Review URL: https://chromiumcodereview.appspot.com/10905232
http://code.google.com/p/v8/source/detail?r=12493
Modified:
/branches/bleeding_edge/src/flag-definitions.h
/branches/bleeding_edge/src/hydrogen.cc
/branches/bleeding_edge/test/mjsunit/array-bounds-check-removal.js
=======================================
--- /branches/bleeding_edge/src/flag-definitions.h Tue Sep 11 07:01:39 2012
+++ /branches/bleeding_edge/src/flag-definitions.h Wed Sep 12 10:00:25 2012
@@ -198,9 +198,9 @@
DEFINE_bool(deoptimize_uncommon_cases, true, "deoptimize uncommon cases")
DEFINE_bool(polymorphic_inlining, true, "polymorphic inlining")
DEFINE_bool(use_osr, true, "use on-stack replacement")
-DEFINE_bool(array_bounds_checks_elimination, false,
+DEFINE_bool(array_bounds_checks_elimination, true,
"perform array bounds checks elimination")
-DEFINE_bool(array_index_dehoisting, false,
+DEFINE_bool(array_index_dehoisting, true,
"perform array index dehoisting")
DEFINE_bool(trace_osr, false, "trace on-stack replacement")
=======================================
--- /branches/bleeding_edge/src/hydrogen.cc Wed Sep 12 05:28:42 2012
+++ /branches/bleeding_edge/src/hydrogen.cc Wed Sep 12 10:00:25 2012
@@ -3432,6 +3432,8 @@
static BoundsCheckKey* Create(Zone* zone,
HBoundsCheck* check,
int32_t* offset) {
+ if (!check->index()->representation().IsInteger32()) return NULL;
+
HValue* index_base = NULL;
HConstant* constant = NULL;
bool is_sub = false;
@@ -3682,6 +3684,7 @@
int32_t offset;
BoundsCheckKey* key =
BoundsCheckKey::Create(zone(), check, &offset);
+ if (key == NULL) continue;
BoundsCheckBbData** data_p = table->LookupOrInsert(key, zone());
BoundsCheckBbData* data = *data_p;
if (data == NULL) {
=======================================
--- /branches/bleeding_edge/test/mjsunit/array-bounds-check-removal.js Tue
Jul 10 04:01:29 2012
+++ /branches/bleeding_edge/test/mjsunit/array-bounds-check-removal.js Wed
Sep 12 10:00:25 2012
@@ -29,6 +29,29 @@
var a = new Int32Array(1024);
+// Test that we do not assert if the accessed index has not an int32 rep.
+var v = [0, 1, 2, 3, 4, 5, 6, 7, 8, 9];
+function test_do_not_assert_on_non_int32(vector, base) {
+ var r = 0;
+ var a1 = base + 1;
+ var a2 = base + 2;
+ var a3 = base + 3;
+ var a4 = base + 4;
+ if (a1 == 2) {
+ r += vector[a1];
+ r += vector[a4];
+ r += vector[a2];
+ r += vector[a3];
+ }
+ return r;
+}
+test_do_not_assert_on_non_int32(v,1);
+test_do_not_assert_on_non_int32(v,1);
+test_do_not_assert_on_non_int32(v,"a");
+test_do_not_assert_on_non_int32(v,"a");
+%OptimizeFunctionOnNextCall(test_do_not_assert_on_non_int32);
+test_do_not_assert_on_non_int32(v,0);
+
function test_base(base,cond) {
a[base + 1] = 1;
a[base + 4] = 2;
--
v8-dev mailing list
[email protected]
http://groups.google.com/group/v8-dev
