Reviewers: Toon Verwaest,
Description:
Fix bogus deopt in BuildEmitDeepCopy for holey arrays.
[email protected]
BUG=chromium:242924
TEST=mjsunit/regress/regress-crbug-242924
Please review this at https://codereview.chromium.org/15735012/
SVN Base: https://v8.googlecode.com/svn/branches/bleeding_edge
Affected files:
M src/hydrogen.cc
A + test/mjsunit/regress/regress-crbug-242924.js
Index: src/hydrogen.cc
diff --git a/src/hydrogen.cc b/src/hydrogen.cc
index
097216ef830b9660042ee31ee2bb82a618ca5e23..4cf86136bdce2d612d254b1e8b57b234c76e57de
100644
--- a/src/hydrogen.cc
+++ b/src/hydrogen.cc
@@ -11012,9 +11012,11 @@ void HOptimizedGraphBuilder::BuildEmitDeepCopy(
AddInstruction(new(zone) HConstant(i,
Representation::Integer32()));
HInstruction* value_instruction =
AddInstruction(new(zone) HLoadKeyed(
- boilerplate_elements, key_constant, NULL, kind));
- AddInstruction(new(zone) HStoreKeyed(
+ boilerplate_elements, key_constant, NULL, kind,
+ ALLOW_RETURN_HOLE));
+ HInstruction* store = AddInstruction(new(zone) HStoreKeyed(
object_elements, key_constant, value_instruction, kind));
+ store->ClearFlag(HValue::kDeoptimizeOnUndefined);
}
} else if (elements->IsFixedArray()) {
Handle<FixedArray> fast_elements =
Handle<FixedArray>::cast(elements);
@@ -11037,7 +11039,8 @@ void HOptimizedGraphBuilder::BuildEmitDeepCopy(
} else {
HInstruction* value_instruction =
AddInstruction(new(zone) HLoadKeyed(
- boilerplate_elements, key_constant, NULL, kind));
+ boilerplate_elements, key_constant, NULL, kind,
+ ALLOW_RETURN_HOLE));
AddInstruction(new(zone) HStoreKeyed(
object_elements, key_constant, value_instruction, kind));
}
Index: test/mjsunit/regress/regress-crbug-242924.js
diff --git a/test/mjsunit/regress/regress-crbug-242870.js
b/test/mjsunit/regress/regress-crbug-242924.js
similarity index 84%
copy from test/mjsunit/regress/regress-crbug-242870.js
copy to test/mjsunit/regress/regress-crbug-242924.js
index
7183375ca811cedc81c870d34e694e98cf727f9b..68ad7c6fd4e3e11b8f6d93e8b8afef01f4b143cd
100644
--- a/test/mjsunit/regress/regress-crbug-242870.js
+++ b/test/mjsunit/regress/regress-crbug-242924.js
@@ -25,19 +25,24 @@
// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
-// Flags: --allow-natives-syntax
-
-var non_const_true = true;
+// Flags: --allow-natives-syntax --expose-gc --gc-global
function f() {
- return (non_const_true || true && g());
+ return [,{}];
}
+assertEquals([,{}], f());
+assertEquals([,{}], f());
+%OptimizeFunctionOnNextCall(f);
+assertEquals([,{}], f());
+gc();
+
function g() {
- for (;;) {}
+ return [[,1.5],{}];
}
-assertTrue(f());
-assertTrue(f());
-%OptimizeFunctionOnNextCall(f);
-assertTrue(f());
+assertEquals([[,1.5],{}], g());
+assertEquals([[,1.5],{}], g());
+%OptimizeFunctionOnNextCall(g);
+assertEquals([[,1.5],{}], g());
+gc();
--
--
v8-dev mailing list
[email protected]
http://groups.google.com/group/v8-dev
---
You received this message because you are subscribed to the Google Groups "v8-dev" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
For more options, visit https://groups.google.com/groups/opt_out.
