Revision: 14917
Author: [email protected]
Date: Mon Jun 3 07:46:23 2013
Log: Special Array constructor type feedback erroneously recorded when
Array
was called as a function. Issue was found with optimize_constructed_array
turned on. This patch makes the fix, and turns the flag back on.
BUG=244461
[email protected]
Review URL: https://codereview.chromium.org/16057005
http://code.google.com/p/v8/source/detail?r=14917
Added:
/branches/bleeding_edge/test/mjsunit/regress/regress-crbug-244461.js
Modified:
/branches/bleeding_edge/src/arm/code-stubs-arm.cc
/branches/bleeding_edge/src/flag-definitions.h
/branches/bleeding_edge/src/ia32/code-stubs-ia32.cc
/branches/bleeding_edge/src/mips/code-stubs-mips.cc
/branches/bleeding_edge/src/x64/code-stubs-x64.cc
/branches/bleeding_edge/test/mjsunit/allocation-site-info.js
=======================================
--- /dev/null
+++ /branches/bleeding_edge/test/mjsunit/regress/regress-crbug-244461.js
Mon Jun 3 07:46:23 2013
@@ -0,0 +1,41 @@
+// Copyright 2012 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --allow-natives-syntax --smi-only-arrays
+// Flags: --track-allocation-sites
+
+function foo(arg) {
+ var a = arg();
+ return a;
+}
+
+
+foo(Array);
+foo(Array);
+%OptimizeFunctionOnNextCall(foo);
+// Compilation of foo will crash without the bugfix for 244461
+foo(Array);
=======================================
--- /branches/bleeding_edge/src/arm/code-stubs-arm.cc Fri May 31 03:48:37
2013
+++ /branches/bleeding_edge/src/arm/code-stubs-arm.cc Mon Jun 3 07:46:23
2013
@@ -4588,7 +4588,6 @@
// megamorphic.
// r1 : the function to call
// r2 : cache cell for call target
- ASSERT(!FLAG_optimize_constructed_arrays);
Label done;
ASSERT_EQ(*TypeFeedbackCells::MegamorphicSentinel(masm->isolate()),
@@ -4732,11 +4731,7 @@
__ b(ne, &slow);
if (RecordCallTarget()) {
- if (FLAG_optimize_constructed_arrays) {
- GenerateRecordCallTarget(masm);
- } else {
- GenerateRecordCallTargetNoArray(masm);
- }
+ GenerateRecordCallTargetNoArray(masm);
}
// Fast-case: Invoke the function now.
=======================================
--- /branches/bleeding_edge/src/flag-definitions.h Tue May 28 11:46:23 2013
+++ /branches/bleeding_edge/src/flag-definitions.h Mon Jun 3 07:46:23 2013
@@ -258,7 +258,7 @@
"eliminate unreachable code (hidden behind soft deopts)")
DEFINE_bool(track_allocation_sites, true,
"Use allocation site info to reduce transitions")
-DEFINE_bool(optimize_constructed_arrays, false,
+DEFINE_bool(optimize_constructed_arrays, true,
"Use allocation site info on constructed arrays")
DEFINE_bool(trace_osr, false, "trace on-stack replacement")
DEFINE_int(stress_runs, 0, "number of stress runs")
=======================================
--- /branches/bleeding_edge/src/ia32/code-stubs-ia32.cc Fri May 31 03:48:37
2013
+++ /branches/bleeding_edge/src/ia32/code-stubs-ia32.cc Mon Jun 3 07:46:23
2013
@@ -4637,7 +4637,6 @@
// megamorphic.
// ebx : cache cell for call target
// edi : the function to call
- ASSERT(!FLAG_optimize_constructed_arrays);
Isolate* isolate = masm->isolate();
Label initialize, done;
@@ -4778,11 +4777,7 @@
__ j(not_equal, &slow);
if (RecordCallTarget()) {
- if (FLAG_optimize_constructed_arrays) {
- GenerateRecordCallTarget(masm);
- } else {
- GenerateRecordCallTargetNoArray(masm);
- }
+ GenerateRecordCallTargetNoArray(masm);
}
// Fast-case: Just invoke the function.
=======================================
--- /branches/bleeding_edge/src/mips/code-stubs-mips.cc Fri May 31 03:48:37
2013
+++ /branches/bleeding_edge/src/mips/code-stubs-mips.cc Mon Jun 3 07:46:23
2013
@@ -4971,7 +4971,6 @@
// megamorphic.
// a1 : the function to call
// a2 : cache cell for call target
- ASSERT(!FLAG_optimize_constructed_arrays);
Label done;
ASSERT_EQ(*TypeFeedbackCells::MegamorphicSentinel(masm->isolate()),
@@ -5114,11 +5113,7 @@
__ Branch(&slow, ne, a3, Operand(JS_FUNCTION_TYPE));
if (RecordCallTarget()) {
- if (FLAG_optimize_constructed_arrays) {
- GenerateRecordCallTarget(masm);
- } else {
- GenerateRecordCallTargetNoArray(masm);
- }
+ GenerateRecordCallTargetNoArray(masm);
}
// Fast-case: Invoke the function now.
=======================================
--- /branches/bleeding_edge/src/x64/code-stubs-x64.cc Fri May 31 03:48:37
2013
+++ /branches/bleeding_edge/src/x64/code-stubs-x64.cc Mon Jun 3 07:46:23
2013
@@ -3672,7 +3672,6 @@
// megamorphic.
// rbx : cache cell for call target
// rdi : the function to call
- ASSERT(!FLAG_optimize_constructed_arrays);
Isolate* isolate = masm->isolate();
Label initialize, done;
@@ -3810,11 +3809,7 @@
__ j(not_equal, &slow);
if (RecordCallTarget()) {
- if (FLAG_optimize_constructed_arrays) {
- GenerateRecordCallTarget(masm);
- } else {
- GenerateRecordCallTargetNoArray(masm);
- }
+ GenerateRecordCallTargetNoArray(masm);
}
// Fast-case: Just invoke the function.
=======================================
--- /branches/bleeding_edge/test/mjsunit/allocation-site-info.js Wed May 29
01:29:25 2013
+++ /branches/bleeding_edge/test/mjsunit/allocation-site-info.js Mon Jun 3
07:46:23 2013
@@ -37,7 +37,7 @@
// support_smi_only_arrays = %HasFastSmiElements(new
Array(1,2,3,4,5,6,7,8));
support_smi_only_arrays = true;
-optimize_constructed_arrays = false;
+optimize_constructed_arrays = true;
if (support_smi_only_arrays) {
print("Tests include smi-only arrays.");
--
--
v8-dev mailing list
[email protected]
http://groups.google.com/group/v8-dev
---
You received this message because you are subscribed to the Google Groups "v8-dev" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
For more options, visit https://groups.google.com/groups/opt_out.
