Revision: 16484
Author:   [email protected]
Date:     Mon Sep  2 16:51:44 2013 UTC
Log:      Fix OSR to ignore phis without merge index in loop entry.

This fixes a corner case introduced by escape analysis where phis are
introduced in OSR loop entry blocks that don't have a merge index and
hence cannot contain OSR values.

[email protected]
TEST=mjsunit/compiler/escape-analysis

Review URL: https://codereview.chromium.org/23503025
http://code.google.com/p/v8/source/detail?r=16484

Modified:
 /branches/bleeding_edge/src/hydrogen-osr.cc
 /branches/bleeding_edge/test/mjsunit/compiler/escape-analysis.js

=======================================
--- /branches/bleeding_edge/src/hydrogen-osr.cc Fri Aug  9 15:18:23 2013 UTC
+++ /branches/bleeding_edge/src/hydrogen-osr.cc Mon Sep  2 16:51:44 2013 UTC
@@ -117,8 +117,9 @@
   const ZoneList<HPhi*>* phis = osr_loop_entry_->phis();
   for (int j = 0; j < phis->length(); j++) {
     HPhi* phi = phis->at(j);
-    ASSERT(phi->HasMergedIndex());
-    osr_values_->at(phi->merged_index())->set_incoming_value(phi);
+    if (phi->HasMergedIndex()) {
+      osr_values_->at(phi->merged_index())->set_incoming_value(phi);
+    }
   }
 }

=======================================
--- /branches/bleeding_edge/test/mjsunit/compiler/escape-analysis.js Wed Aug 28 14:16:57 2013 UTC +++ /branches/bleeding_edge/test/mjsunit/compiler/escape-analysis.js Mon Sep 2 16:51:44 2013 UTC
@@ -200,3 +200,44 @@
   check(27, 27); check(27, 27);
   assertEquals(130, sum);
 })();
+
+
+// Test OSR into a loop with captured objects.
+(function testOSR() {
+  function constructor() {
+    this.a = 23;
+  }
+  function osr1(length) {
+    assertEquals(23, (new constructor()).a);
+    var result = 0;
+    for (var i = 0; i < length; i++) {
+      result = (result + i) % 99;
+    }
+    return result;
+  }
+  function osr2(length) {
+    var result = 0;
+    for (var i = 0; i < length; i++) {
+      result = (result + i) % 99;
+    }
+    assertEquals(23, (new constructor()).a);
+    return result;
+  }
+  function osr3(length) {
+    var result = 0;
+    var o = new constructor();
+    for (var i = 0; i < length; i++) {
+      result = (result + i) % 99;
+    }
+    assertEquals(23, o.a);
+    return result;
+  }
+  function test(closure) {
+    assertEquals(45, closure(10));
+    assertEquals(45, closure(10));
+    assertEquals(10, closure(50000));
+  }
+  test(osr1);
+  test(osr2);
+  test(osr3);
+})();

--
--
v8-dev mailing list
[email protected]
http://groups.google.com/group/v8-dev
--- You received this message because you are subscribed to the Google Groups "v8-dev" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to [email protected].
For more options, visit https://groups.google.com/groups/opt_out.

Reply via email to