Reviewers: titzer, ulan,
Message:
PTAL
Description:
Fix wrong bailout id in polymorphic stores.
BUG=chromium:259787
Please review this at https://chromiumcodereview.appspot.com/19528005/
SVN Base: https://v8.googlecode.com/svn/branches/bleeding_edge
Affected files:
M src/hydrogen.h
M src/hydrogen.cc
A + test/mjsunit/regress/poly_count_operation.js
Index: src/hydrogen.cc
diff --git a/src/hydrogen.cc b/src/hydrogen.cc
index
627dec94790809db19d4472d1da3061265589494..e45026149631a33ae87b9d81887eb1526b771d3a
100644
--- a/src/hydrogen.cc
+++ b/src/hydrogen.cc
@@ -4841,7 +4841,6 @@ bool
HOptimizedGraphBuilder::TryStorePolymorphicAsMonomorphic(
void HOptimizedGraphBuilder::HandlePolymorphicStoreNamedField(
- BailoutId id,
int position,
BailoutId assignment_id,
HValue* object,
@@ -4914,11 +4913,11 @@ void
HOptimizedGraphBuilder::HandlePolymorphicStoreNamedField(
// unoptimized code).
if (instr->HasObservableSideEffects()) {
if (ast_context()->IsEffect()) {
- AddSimulate(id, REMOVABLE_SIMULATE);
+ AddSimulate(assignment_id, REMOVABLE_SIMULATE);
} else {
if (result_value != NULL) Push(result_value);
Push(store_value);
- AddSimulate(id, REMOVABLE_SIMULATE);
+ AddSimulate(assignment_id, REMOVABLE_SIMULATE);
Drop(result_value != NULL ? 2 : 1);
}
}
@@ -4928,7 +4927,7 @@ void
HOptimizedGraphBuilder::HandlePolymorphicStoreNamedField(
}
ASSERT(join != NULL);
- join->SetJoinId(id);
+ join->SetJoinId(assignment_id);
set_current_block(join);
if (!ast_context()->IsEffect()) {
if (result_value != NULL) Drop(1);
@@ -5062,7 +5061,7 @@ void
HOptimizedGraphBuilder::BuildStoreNamed(Expression* expr,
} else if (types != NULL && types->length() > 1) {
Drop(2);
return HandlePolymorphicStoreNamedField(
- id, position, assignment_id, object,
+ position, assignment_id, object,
store_value, result_value, types, name);
} else {
Drop(2);
Index: src/hydrogen.h
diff --git a/src/hydrogen.h b/src/hydrogen.h
index
7d9a7affb8f10f4faac1fb7ba9672e1ab963c558..23210535cfac17ee7874b4a192c07d3335ceb4fd
100644
--- a/src/hydrogen.h
+++ b/src/hydrogen.h
@@ -1741,8 +1741,7 @@ class HOptimizedGraphBuilder: public HGraphBuilder,
public AstVisitor {
HValue* object,
SmallMapList* types,
Handle<String> name);
- void HandlePolymorphicStoreNamedField(BailoutId id,
- int position,
+ void HandlePolymorphicStoreNamedField(int position,
BailoutId assignment_id,
HValue* object,
HValue* value,
Index: test/mjsunit/regress/poly_count_operation.js
diff --git a/test/mjsunit/regress/regress-crbug-243868.js
b/test/mjsunit/regress/poly_count_operation.js
similarity index 70%
copy from test/mjsunit/regress/regress-crbug-243868.js
copy to test/mjsunit/regress/poly_count_operation.js
index
106d9cc78bce7795cd450fa0d07794f9f004a3af..2fd15ea15259dc5a2f8f3aaf3c7b5117408f016e
100644
--- a/test/mjsunit/regress/regress-crbug-243868.js
+++ b/test/mjsunit/regress/poly_count_operation.js
@@ -27,20 +27,45 @@
// Flags: --allow-natives-syntax
-var non_const_true = true;
+var o1 = {x:1};
+var o2 = {};
+var deopt = false;
-function f(o) {
- return (non_const_true && (o.val == null || false));
+function f_mono(o) {
+ return 5 + o.x++;
}
-// Create an object with a constant function in another realm.
-var realm = Realm.create();
-var realmObject = Realm.eval(realm, "function g() {}; var o = { val:g };
o;")
+var to_deopt = f_mono;
-// Make the CompareNil IC in the function monomorphic.
-assertFalse(f(realmObject));
-assertFalse(f(realmObject));
+var v = 1;
-// Optimize the function containing the CompareNil IC.
-%OptimizeFunctionOnNextCall(f);
-assertFalse(f(realmObject));
+Object.defineProperty(o2, "x",
+ {get:function() { return v; },
+ set:function(new_v) {
+ v = new_v;
+ if (deopt) {
+ deopt = false;
+ %DeoptimizeFunction(to_deopt);
+ }
+ }});
+
+assertEquals(6, f_mono(o2));
+assertEquals(7, f_mono(o2));
+%OptimizeFunctionOnNextCall(f_mono);
+deopt = true;
+assertEquals(8, f_mono(o2));
+
+function f_poly(o) {
+ return 5 + o.x++;
+}
+
+v = 1;
+to_deopt = f_poly;
+
+f_poly(o1);
+f_poly(o1);
+assertEquals(6, f_poly(o2));
+assertEquals(7, f_poly(o2));
+%OptimizeFunctionOnNextCall(f_poly);
+deopt = true;
+assertEquals(8, f_poly(o2));
--
--
v8-dev mailing list
[email protected]
http://groups.google.com/group/v8-dev
---
You received this message because you are subscribed to the Google Groups "v8-dev" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
For more options, visit https://groups.google.com/groups/opt_out.
