Reviewers: Jakob,
Message:
PTAL
Description:
Only fold polymorphic into monomorphic load if all load from either
receiver or
same prototype.
Please review this at https://chromiumcodereview.appspot.com/25718002/
SVN Base: https://v8.googlecode.com/svn/branches/bleeding_edge
Affected files (+16, -14 lines):
M src/hydrogen.cc
A + test/mjsunit/regress/regress-polymorphic-load.js
Index: src/hydrogen.cc
diff --git a/src/hydrogen.cc b/src/hydrogen.cc
index
f59f988534f20c3b7a63fdb7cc0425b8d0c3e4b5..3705042adc7cff58c835e3894ed697c63766e9ad
100644
--- a/src/hydrogen.cc
+++ b/src/hydrogen.cc
@@ -4707,10 +4707,14 @@ bool
HOptimizedGraphBuilder::PropertyAccessInfo::IsCompatibleForLoad(
if (!LookupDescriptor()) return false;
if (!lookup_.IsFound()) {
- return (!info->lookup_.IsFound() || !info->holder_.is_null()) &&
+ return (!info->lookup_.IsFound() || info->has_holder()) &&
map_->prototype() == info->map_->prototype();
}
+ // Mismatch if the other access info found the property in the prototype
+ // chain.
+ if (info->has_holder()) return false;
+
if (lookup_.IsPropertyCallbacks()) {
return accessor_.is_identical_to(info->accessor_);
}
Index: test/mjsunit/regress/regress-polymorphic-load.js
diff --git a/test/mjsunit/regress/regress-2671.js
b/test/mjsunit/regress/regress-polymorphic-load.js
similarity index 91%
copy from test/mjsunit/regress/regress-2671.js
copy to test/mjsunit/regress/regress-polymorphic-load.js
index
8da1b8f07f69c487fe9913e485c60f3e257e0986..2545e85f60a2c7fe8f68dd9c667e38a0528ff127
100644
--- a/test/mjsunit/regress/regress-2671.js
+++ b/test/mjsunit/regress/regress-polymorphic-load.js
@@ -27,19 +27,17 @@
// Flags: --allow-natives-syntax
-var y;
-function f() {
- var a = [];
- a[20] = 0;
- y = 3;
- var i = 7 * (y + -0);
- a[i] = 1/y;
- assertFalse(isNaN(a[i]));
+function f(o) {
+ return o.x;
}
-f();
-f();
-f();
-%OptimizeFunctionOnNextCall(f);
-f();
+var o1 = {x:1};
+var o2 = {__proto__: {x:2}};
+f(o2);
+f(o2);
+f(o2);
+f(o1);
+%OptimizeFunctionOnNextCall(f);
+assertEquals(1, f(o1));
+assertEquals(2, f(o2));
--
--
v8-dev mailing list
[email protected]
http://groups.google.com/group/v8-dev
---
You received this message because you are subscribed to the Google Groups "v8-dev" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
For more options, visit https://groups.google.com/groups/opt_out.
