Reviewers: Hannes Payer,
Message:
PTAL.
Description:
Fix switch statements with non-Smi integer labels and no type feedback
BUG=chromium:329709
LOG=Y
Please review this at https://codereview.chromium.org/98643010/
SVN Base: https://v8.googlecode.com/svn/branches/bleeding_edge
Affected files (+18, -21 lines):
M src/hydrogen.cc
A + test/mjsunit/regress/regress-crbug-329709.js
Index: src/hydrogen.cc
diff --git a/src/hydrogen.cc b/src/hydrogen.cc
index
e8f7a44cac3ad7c1afcbfcd4828fc9d1cbc035e0..cccfa5b041ee7ee3cf12f747f69dea295f0fcd32
100644
--- a/src/hydrogen.cc
+++ b/src/hydrogen.cc
@@ -9170,15 +9170,6 @@ void
HOptimizedGraphBuilder::VisitCompareOperation(CompareOperation* expr) {
return ast_context()->ReturnInstruction(result, expr->id());
}
- // Cases handled below depend on collected type feedback. They should
- // soft deoptimize when there is no type feedback.
- if (combined_type->Is(Type::None())) {
- Add<HDeoptimize>("Insufficient type feedback for combined type "
- "of binary operation",
- Deoptimizer::SOFT);
- combined_type = left_type = right_type = handle(Type::Any(),
isolate());
- }
-
HControlInstruction* compare = BuildCompareInstruction(
op, left, right, left_type, right_type, combined_type,
expr->left()->position(), expr->right()->position(), expr->id());
@@ -9197,6 +9188,15 @@ HControlInstruction*
HOptimizedGraphBuilder::BuildCompareInstruction(
int left_position,
int right_position,
BailoutId bailout_id) {
+ // Cases handled below depend on collected type feedback. They should
+ // soft deoptimize when there is no type feedback.
+ if (combined_type->Is(Type::None())) {
+ Add<HDeoptimize>("Insufficient type feedback for combined type "
+ "of binary operation",
+ Deoptimizer::SOFT);
+ combined_type = left_type = right_type = handle(Type::Any(),
isolate());
+ }
+
Representation left_rep = Representation::FromType(left_type);
Representation right_rep = Representation::FromType(right_type);
Representation combined_rep = Representation::FromType(combined_type);
Index: test/mjsunit/regress/regress-crbug-329709.js
diff --git a/test/mjsunit/regress/regress-264203.js
b/test/mjsunit/regress/regress-crbug-329709.js
similarity index 85%
copy from test/mjsunit/regress/regress-264203.js
copy to test/mjsunit/regress/regress-crbug-329709.js
index
fa0075662575d85241b6af82c5945cca32938991..c5316f391ce34dee57873417dc84d94e254868d4
100644
--- a/test/mjsunit/regress/regress-264203.js
+++ b/test/mjsunit/regress/regress-crbug-329709.js
@@ -27,18 +27,15 @@
// Flags: --allow-natives-syntax
-function foo(x) {
- var a = [1, 2, 3, 4, 5, 6, 7, 8];
- a[x + 5];
- var result;
- for (var i = 0; i < 3; i++) {
- result = a[0 - x];
+function boom(x) {
+ switch(x) {
+ case 1: return "one";
+ case 1500000000: return "non-smi int32";
+ default: return "default";
}
- return result;
}
-foo(0);
-foo(0);
-%OptimizeFunctionOnNextCall(foo);
-var r = foo(-2);
-assertEquals(3, r);
+assertEquals("one", boom(1));
+assertEquals("one", boom(1));
+%OptimizeFunctionOnNextCall(boom)
+assertEquals("non-smi int32", boom(1500000000));
--
--
v8-dev mailing list
[email protected]
http://groups.google.com/group/v8-dev
---
You received this message because you are subscribed to the Google Groups "v8-dev" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
For more options, visit https://groups.google.com/groups/opt_out.
