Reviewers: Yang,
Description:
Add regression test for r13617
Many thanks to Vyacheslav Egorov for coming up with this test!
BUG=173907
Please review this at https://codereview.chromium.org/12212066/
SVN Base: https://v8.googlecode.com/svn/branches/bleeding_edge
Affected files:
test/mjsunit/regress/regress-crbug-173907.js
Index: test/mjsunit/regress/regress-crbug-173907.js
diff --git a/test/mjsunit/compiler/property-static.js
b/test/mjsunit/regress/regress-crbug-173907.js
similarity index 54%
copy from test/mjsunit/compiler/property-static.js
copy to test/mjsunit/regress/regress-crbug-173907.js
index
07021340cd7aa94440638f925eeed921ee78c9c7..9f92fefa7880d65771fbbe70aedb13d2d039f58e
100644
--- a/test/mjsunit/compiler/property-static.js
+++ b/test/mjsunit/regress/regress-crbug-173907.js
@@ -27,43 +27,62 @@
// Flags: --allow-natives-syntax
-// Test usage of static type information for loads that would otherwise
-// turn into polymorphic or generic loads.
+var X = 1.1;
+var K = 0.5;
-// Prepare a highly polymorphic load to be used by all tests.
-Object.prototype.load = function() { return this.property; };
-Object.prototype.load.call({ A:0, property:10 });
-Object.prototype.load.call({ A:0, B:0, property:11 });
-Object.prototype.load.call({ A:0, B:0, C:0, property:12 });
-Object.prototype.load.call({ A:0, B:0, C:0, D:0, property:13 });
-Object.prototype.load.call({ A:0, B:0, C:0, D:0, E:0, property:14 });
-Object.prototype.load.call({ A:0, B:0, C:0, D:0, E:0, F:0, property:15 });
+var O = 0;
+var result = new Float64Array(2);
-// Test for object literals.
-(function() {
- function f(x) {
- var object = { property:x };
- return object.load();
- }
+function spill() {
+ try { } catch (e) { }
+}
- assertSame(1, f(1));
- assertSame(2, f(2));
- %OptimizeFunctionOnNextCall(f);
- assertSame(3, f(3));
-})();
+function buggy() {
+ var v = X;
+ var phi1 = v + K;
+ var phi2 = v - K;
-// Test for inlined constructors.
-(function() {
- function c(x) {
- this.property = x;
- }
- function f(x) {
- var object = new c(x);
- return object.load();
+ spill(); // At this point initial values for phi1 and phi2 are spilled.
+
+ var xmm1 = v;
+ var xmm2 = v*v*v;
+ var xmm3 = v*v*v*v;
+ var xmm4 = v*v*v*v*v;
+ var xmm5 = v*v*v*v*v*v;
+ var xmm6 = v*v*v*v*v*v*v;
+ var xmm7 = v*v*v*v*v*v*v*v;
+ var xmm8 = v*v*v*v*v*v*v*v*v;
+
+ // All registers are blocked and phis for phi1 and phi2 are spilled
because
+ // their left (incoming) value is spilled, there are no free registers,
+ // and phis themselves have only ANY-policy uses.
+
+ for (var x = 0; x < 2; x++) {
+ xmm1 += xmm1 * xmm6;
+ xmm2 += xmm1 * xmm5;
+ xmm3 += xmm1 * xmm4;
+ xmm4 += xmm1 * xmm3;
+ xmm5 += xmm1 * xmm2;
+
+ // Now swap values of phi1 and phi2 to create cycle between phis.
+ var t = phi1;
+ phi1 = phi2;
+ phi2 = t;
}
- assertSame(1, f(1));
- assertSame(2, f(2));
- %OptimizeFunctionOnNextCall(f);
- assertSame(3, f(3));
-})();
+ // Now we want to get values of phi1 and phi2. However we would like to
+ // do it in a way that does not produce any uses of phi1&phi2 that have
+ // a register beneficial policy. How? We just hide these uses behind
phis.
+ result[0] = (O === 0) ? phi1 : phi2;
+ result[1] = (O !== 0) ? phi1 : phi2;
+}
+
+function test() {
+ buggy();
+ assertArrayEquals([X + K, X - K], result);
+}
+
+test();
+test();
+%OptimizeFunctionOnNextCall(buggy);
+test();
--
--
v8-dev mailing list
[email protected]
http://groups.google.com/group/v8-dev
---
You received this message because you are subscribed to the Google Groups "v8-dev" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
For more options, visit https://groups.google.com/groups/opt_out.
