Reviewers: danno,
Message:
PTAL.
Description:
Deopt on storing undefined into double elements.
Please review this at https://chromiumcodereview.appspot.com/10963010/
SVN Base: https://v8.googlecode.com/svn/branches/bleeding_edge
Affected files:
M src/hydrogen-instructions.h
M test/mjsunit/elements-transition-hoisting.js
A + test/mjsunit/regress/regress-undefined-store-keyed-fast-element.js
Index: src/hydrogen-instructions.h
diff --git a/src/hydrogen-instructions.h b/src/hydrogen-instructions.h
index
c87bb553b11b96e2790b63d96e8d428f853abc6d..dfffe41fca745672ace8ec5ec05774e91de132ed
100644
--- a/src/hydrogen-instructions.h
+++ b/src/hydrogen-instructions.h
@@ -4527,6 +4527,7 @@ class HStoreKeyedFastDoubleElement
SetOperandAt(0, elements);
SetOperandAt(1, key);
SetOperandAt(2, val);
+ SetFlag(kDeoptimizeOnUndefined);
SetGVNFlag(kChangesDoubleArrayElements);
}
Index: test/mjsunit/elements-transition-hoisting.js
diff --git a/test/mjsunit/elements-transition-hoisting.js
b/test/mjsunit/elements-transition-hoisting.js
index
5fb3889c6e1b214755e68f0ec35ce34ed87e4af9..6adbaca83950e4ef47a0ce1b6a08edbf2d833568
100644
--- a/test/mjsunit/elements-transition-hoisting.js
+++ b/test/mjsunit/elements-transition-hoisting.js
@@ -226,7 +226,7 @@ if (support_smi_only_arrays) {
testStraightLineDupeElinination(new Array(5),0,0,0,.5,0);
testStraightLineDupeElinination(new Array(5),0,0,0,0,.5);
%OptimizeFunctionOnNextCall(testStraightLineDupeElinination);
- testStraightLineDupeElinination(new Array(5));
- testStraightLineDupeElinination(new Array(5));
+ testStraightLineDupeElinination(new Array(5),0,0,0,0,0);
+ testStraightLineDupeElinination(new Array(5),0,0,0,0,0);
assertTrue(2 != %GetOptimizationStatus(testStraightLineDupeElinination));
}
Index: test/mjsunit/regress/regress-undefined-store-keyed-fast-element.js
diff --git a/test/mjsunit/regress/regress-1898.js
b/test/mjsunit/regress/regress-undefined-store-keyed-fast-element.js
similarity index 89%
copy from test/mjsunit/regress/regress-1898.js
copy to test/mjsunit/regress/regress-undefined-store-keyed-fast-element.js
index
5440446fbf78ca593e8748cd54ea2aefad047542..9e6ec9db07ec3bb127b4f15a432700e637d5ccbd
100644
--- a/test/mjsunit/regress/regress-1898.js
+++ b/test/mjsunit/regress/regress-undefined-store-keyed-fast-element.js
@@ -27,11 +27,11 @@
// Flags: --allow-natives-syntax
-function f(x) {
- Math.log(Math.min(0.1, Math.abs(x)));
+function f(v) {
+ return [0.0, 0.1, 0.2, v];
}
-f(0.1);
-f(0.1);
+assertEquals([0.0, 0.1, 0.2, NaN], f(NaN));
+assertEquals([0.0, 0.1, 0.2, NaN], f(NaN));
%OptimizeFunctionOnNextCall(f);
-f(0.1);
+assertEquals([0.0, 0.1, 0.2, undefined], f(undefined));
--
v8-dev mailing list
[email protected]
http://groups.google.com/group/v8-dev
