Revision: 15629
Author: [email protected]
Date: Thu Jul 11 06:08:36 2013
Log: AllocationSites: when updating allocation site transition
information,
be careful to merge feedback appropriately. For example, one array may
have gone holey, and then another allocated at the same place instead
went DOUBLE but remained packed. In this case the ElementsKind
ultimately stored in the AllocationSite should be HOLEY_DOUBLE.
BUG=
[email protected]
Review URL: https://codereview.chromium.org/18531007
http://code.google.com/p/v8/source/detail?r=15629
Modified:
/branches/bleeding_edge/src/objects.cc
/branches/bleeding_edge/test/mjsunit/allocation-site-info.js
=======================================
--- /branches/bleeding_edge/src/objects.cc Wed Jul 10 12:03:58 2013
+++ /branches/bleeding_edge/src/objects.cc Thu Jul 11 06:08:36 2013
@@ -12317,6 +12317,10 @@
if (site->IsLiteralSite()) {
JSArray* transition_info = JSArray::cast(site->transition_info());
ElementsKind kind = transition_info->GetElementsKind();
+ // if kind is holey ensure that to_kind is as well.
+ if (IsHoleyElementsKind(kind)) {
+ to_kind = GetHoleyElementsKind(to_kind);
+ }
if (AllocationSite::GetMode(kind, to_kind) == TRACK_ALLOCATION_SITE) {
// If the array is huge, it's not likely to be defined in a local
// function, so we shouldn't make new instances of it very often.
@@ -12335,6 +12339,10 @@
}
} else {
ElementsKind kind = site->GetElementsKind();
+ // if kind is holey ensure that to_kind is as well.
+ if (IsHoleyElementsKind(kind)) {
+ to_kind = GetHoleyElementsKind(to_kind);
+ }
if (AllocationSite::GetMode(kind, to_kind) == TRACK_ALLOCATION_SITE) {
if (FLAG_trace_track_allocation_sites) {
PrintF("AllocationSite: JSArray %p site updated %s->%s\n",
=======================================
--- /branches/bleeding_edge/test/mjsunit/allocation-site-info.js Thu Jul 11
02:39:22 2013
+++ /branches/bleeding_edge/test/mjsunit/allocation-site-info.js Thu Jul 11
06:08:36 2013
@@ -282,6 +282,32 @@
obj = newarraycase_list_smiobj(2);
assertKind(elements_kind.fast, obj);
+ // Case: array constructor calls with out of date feedback.
+ // The boilerplate should incorporate all feedback, but the input array
+ // should be minimally transitioned based on immediate need.
+ (function() {
+ function foo(i) {
+ // We have two cases, one for literals one for constructed arrays.
+ var a = (i == 0)
+ ? [1, 2, 3]
+ : new Array(1, 2, 3);
+ return a;
+ }
+
+ for (i = 0; i < 2; i++) {
+ a = foo(i);
+ b = foo(i);
+ b[5] = 1; // boilerplate goes holey
+ assertHoley(foo(i));
+ a[0] = 3.5; // boilerplate goes holey double
+ assertKind(elements_kind.fast_double, a);
+ assertNotHoley(a);
+ c = foo(i);
+ assertKind(elements_kind.fast_double, c);
+ assertHoley(c);
+ }
+ })();
+
function newarraycase_onearg(len, value) {
var a = new Array(len);
a[0] = value;
--
--
v8-dev mailing list
[email protected]
http://groups.google.com/group/v8-dev
---
You received this message because you are subscribed to the Google Groups "v8-dev" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
For more options, visit https://groups.google.com/groups/opt_out.
