Reviewers: Benedikt Meurer,
Description:
Fixed floor-of-div optimization.
We removed an HDiv by hand which was still used by an HChange. The
solution is letting dead code removal do the cleanup.
Removed a fragile "optimization" (looking through an HChange), too,
this obviously never triggered and is hard to get right given all our
global invariants and state/type/... changes.
The repro is a bit tricky, because you need inlining to make our
representations and types disagree in this case.
BUG=334708
Please review this at https://codereview.chromium.org/143903016/
SVN Base: https://v8.googlecode.com/svn/branches/bleeding_edge
Affected files (+11, -21 lines):
M src/hydrogen-instructions.cc
A + test/mjsunit/regress/regress-334708.js
Index: src/hydrogen-instructions.cc
diff --git a/src/hydrogen-instructions.cc b/src/hydrogen-instructions.cc
index
062b5ae7ace247dc6a38891952d77c0f827c7143..453239b62c6517a567eed450a1a204223dfa6100
100644
--- a/src/hydrogen-instructions.cc
+++ b/src/hydrogen-instructions.cc
@@ -1442,7 +1442,6 @@ HValue* HUnaryMathOperation::Canonicalize() {
if (op() == kMathFloor) {
HValue* val = value();
- if (val->IsChange()) val = HChange::cast(val)->value();
if (val->IsDiv() && (val->UseCount() == 1)) {
HDiv* hdiv = HDiv::cast(val);
HValue* left = hdiv->left();
@@ -1481,17 +1480,8 @@ HValue* HUnaryMathOperation::Canonicalize() {
}
HMathFloorOfDiv* instr =
HMathFloorOfDiv::New(block()->zone(), context(), new_left,
new_right);
- // Replace this HMathFloor instruction by the new HMathFloorOfDiv.
instr->InsertBefore(this);
- ReplaceAllUsesWith(instr);
- Kill();
- // We know the division had no other uses than this HMathFloor.
Delete it.
- // Dead code elimination will deal with |left| and |right| if
- // appropriate.
- hdiv->DeleteAndReplaceWith(NULL);
-
- // Return NULL to remove this instruction from the graph.
- return NULL;
+ return instr;
}
}
return this;
Index: test/mjsunit/regress/regress-334708.js
diff --git a/test/mjsunit/regress-333594.js
b/test/mjsunit/regress/regress-334708.js
similarity index 90%
copy from test/mjsunit/regress-333594.js
copy to test/mjsunit/regress/regress-334708.js
index
6f6dbaafcd64d8b752226a290df525ca200b69a0..f0291bbdab61128baad9df89457d045b66644f1b
100644
--- a/test/mjsunit/regress-333594.js
+++ b/test/mjsunit/regress/regress-334708.js
@@ -27,16 +27,16 @@
// Flags: --allow-natives-syntax
-var a = { x: 1.1 };
-a.x = 0;
-var G = a.x;
-var o = { x: {} };
+function foo(x, y) {
+ return Math.floor(x / y);
+}
-function func() {
- return {x: G};
+function bar(x, y) {
+ return foo(x + 1, y + 1);
}
-func();
-func();
-%OptimizeFunctionOnNextCall(func);
-assertEquals(0, func().x);
+foo(16, "4");
+
+bar(64, 2);
+%OptimizeFunctionOnNextCall(bar);
+bar(64, 2);
--
--
v8-dev mailing list
[email protected]
http://groups.google.com/group/v8-dev
---
You received this message because you are subscribed to the Google Groups "v8-dev" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
For more options, visit https://groups.google.com/groups/opt_out.
