Reviewers: Michael Starzinger,
Description:
Fixed type feedback in presence of negative lookups.
To fix the issue at hand regarding constant function calls and perhaps
other hidden issues regarding negative lookups, we basically add a
"marker instruction", just for harvesting purposes. Our type feedback
oracle is really, really fragile, we should better switch to some more
explicit and robust scheme soon.
BUG=chrome:252797
Please review this at https://codereview.chromium.org/19588002/
SVN Base: https://v8.googlecode.com/svn/branches/bleeding_edge
Affected files:
M src/arm/stub-cache-arm.cc
M src/ia32/stub-cache-ia32.cc
M src/mips/stub-cache-mips.cc
M src/x64/stub-cache-x64.cc
A + test/mjsunit/regress/regress-252797.js
Index: src/arm/stub-cache-arm.cc
diff --git a/src/arm/stub-cache-arm.cc b/src/arm/stub-cache-arm.cc
index
3bec1c5af1afd17ad117cdd7e9a62dd4726006b3..d9354d3823630afc1c4836fe6c414fe455fb52d6
100644
--- a/src/arm/stub-cache-arm.cc
+++ b/src/arm/stub-cache-arm.cc
@@ -1185,6 +1185,9 @@ Register
StubCompiler::CheckPrototypes(Handle<JSObject> object,
int save_at_depth,
Label* miss,
PrototypeCheckType check) {
+ // Make sure that the type feedback oracle harvests the receiver map.
+ __ mov(scratch1, Operand(Handle<Map>(object->map())));
+
Handle<JSObject> first = object;
// Make sure there's no overlap between holder and object registers.
ASSERT(!scratch1.is(object_reg) && !scratch1.is(holder_reg));
Index: src/ia32/stub-cache-ia32.cc
diff --git a/src/ia32/stub-cache-ia32.cc b/src/ia32/stub-cache-ia32.cc
index
66333755ef4a5c2943333f45b6afcb442cc1098d..081de32f76ea237a95ef88bfe2228ec62fb1ac96
100644
--- a/src/ia32/stub-cache-ia32.cc
+++ b/src/ia32/stub-cache-ia32.cc
@@ -1132,6 +1132,9 @@ Register
StubCompiler::CheckPrototypes(Handle<JSObject> object,
int save_at_depth,
Label* miss,
PrototypeCheckType check) {
+ // Make sure that the type feedback oracle harvests the receiver map.
+ __ mov(scratch1, Handle<Map>(object->map()));
+
Handle<JSObject> first = object;
// Make sure there's no overlap between holder and object registers.
ASSERT(!scratch1.is(object_reg) && !scratch1.is(holder_reg));
Index: src/mips/stub-cache-mips.cc
diff --git a/src/mips/stub-cache-mips.cc b/src/mips/stub-cache-mips.cc
index
b7ffb4f202a71b5d7c92f5303c447c281033e936..d903e572003054fffde3ae74e646d3753c229bb2
100644
--- a/src/mips/stub-cache-mips.cc
+++ b/src/mips/stub-cache-mips.cc
@@ -1192,6 +1192,9 @@ Register
StubCompiler::CheckPrototypes(Handle<JSObject> object,
int save_at_depth,
Label* miss,
PrototypeCheckType check) {
+ // Make sure that the type feedback oracle harvests the receiver map.
+ __ li(scratch1, Operand(Handle<Map>(object->map())));
+
Handle<JSObject> first = object;
// Make sure there's no overlap between holder and object registers.
ASSERT(!scratch1.is(object_reg) && !scratch1.is(holder_reg));
Index: src/x64/stub-cache-x64.cc
diff --git a/src/x64/stub-cache-x64.cc b/src/x64/stub-cache-x64.cc
index
bde1d0b377073272e8dbfe163ef3c35aafcc03ec..7e4fdeabc4c313e4de8c06f0fe619ba4701ac3d4
100644
--- a/src/x64/stub-cache-x64.cc
+++ b/src/x64/stub-cache-x64.cc
@@ -1059,6 +1059,9 @@ Register
StubCompiler::CheckPrototypes(Handle<JSObject> object,
int save_at_depth,
Label* miss,
PrototypeCheckType check) {
+ // Make sure that the type feedback oracle harvests the receiver map.
+ __ Move(scratch1, Handle<Map>(object->map()));
+
Handle<JSObject> first = object;
// Make sure there's no overlap between holder and object registers.
ASSERT(!scratch1.is(object_reg) && !scratch1.is(holder_reg));
Index: test/mjsunit/regress/regress-252797.js
diff --git a/test/mjsunit/regress/regress-crbug-233737.js
b/test/mjsunit/regress/regress-252797.js
similarity index 64%
copy from test/mjsunit/regress/regress-crbug-233737.js
copy to test/mjsunit/regress/regress-252797.js
index
835726b22429ec3cca68df956255d47c53fcfd25..406be85b59fb210f91e429c7e97473507cc77168
100644
--- a/test/mjsunit/regress/regress-crbug-233737.js
+++ b/test/mjsunit/regress/regress-252797.js
@@ -27,16 +27,31 @@
// Flags: --allow-natives-syntax
-var a = new Array(2);
-a[0] = 1;
-assertTrue(%HasFastSmiElements(a));
-assertTrue(%HasFastHoleyElements(a));
+// The type feedback oracle had a bug when retrieving the map from an IC
+// starting with a negative lookup.
-function hole(i) {
- return a[i] << 0;
+// Create a holder in fast mode.
+var holder = Object.create(null, {
+ holderMethod: {value: function() {}}
+});
+assertTrue(%HasFastProperties(holder));
+
+// Create a receiver into dictionary mode.
+var receiver = Object.create(holder, {
+ killMe: {value: 0, configurable: true},
+});
+delete receiver.killMe;
+assertFalse(%HasFastProperties(receiver));
+
+// The actual function to test, triggering the retrieval of the wrong map.
+function callConstantFunctionOnPrototype(obj) {
+ obj.holderMethod();
}
-assertEquals(1, hole(0));
-assertEquals(1, hole(0));
-%OptimizeFunctionOnNextCall(hole);
-assertEquals(0, hole(1));
\ No newline at end of file
+callConstantFunctionOnPrototype(receiver);
+callConstantFunctionOnPrototype(receiver);
+%OptimizeFunctionOnNextCall(callConstantFunctionOnPrototype);
+callConstantFunctionOnPrototype(receiver);
+
+// Make sure that the function is still optimized.
+assertTrue(2 != %GetOptimizationStatus(callConstantFunctionOnPrototype));
--
--
v8-dev mailing list
[email protected]
http://groups.google.com/group/v8-dev
---
You received this message because you are subscribed to the Google Groups "v8-dev" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
For more options, visit https://groups.google.com/groups/opt_out.
