Reviewers: Jakob,
Description:
Fix short-circuiting logical and/or in HOptimizedGraphBuilder.
[email protected]
BUG=336148
LOG=Y
Please review this at https://codereview.chromium.org/143263022/
SVN Base: https://v8.googlecode.com/svn/branches/bleeding_edge
Affected files (+32, -14 lines):
M src/hydrogen.cc
A + test/mjsunit/regress/regress-crbug-336148.js
Index: src/hydrogen.cc
diff --git a/src/hydrogen.cc b/src/hydrogen.cc
index
478d938cf6fa27d74994d43674af59ca7f05ef41..efa47e0c3f7659207a116f0fe3a5c283a88b4580
100644
--- a/src/hydrogen.cc
+++ b/src/hydrogen.cc
@@ -9522,11 +9522,14 @@ void
HOptimizedGraphBuilder::VisitLogicalExpression(BinaryOperation* expr) {
ASSERT(current_block() != NULL);
HValue* left_value = Top();
- if (left_value->IsConstant()) {
- HConstant* left_constant = HConstant::cast(left_value);
- if ((is_logical_and && left_constant->BooleanValue()) ||
- (!is_logical_and && !left_constant->BooleanValue())) {
- Drop(1); // left_value.
+ // Short-circuit left values that always evaluate to the same boolean
value.
+ if (expr->left()->ToBooleanIsTrue() ||
expr->left()->ToBooleanIsFalse()) {
+ // l (evals true) && r -> r
+ // l (evals true) || r -> l
+ // l (evals false) && r -> l
+ // l (evals false) || r -> r
+ if (is_logical_and == expr->left()->ToBooleanIsTrue()) {
+ Drop(1);
CHECK_ALIVE(VisitForValue(expr->right()));
}
return ast_context()->ReturnValue(Pop());
Index: test/mjsunit/regress/regress-crbug-336148.js
diff --git a/test/mjsunit/regress/regress-array-pop-deopt.js
b/test/mjsunit/regress/regress-crbug-336148.js
similarity index 78%
copy from test/mjsunit/regress/regress-array-pop-deopt.js
copy to test/mjsunit/regress/regress-crbug-336148.js
index
9a0d35d3aa61b0bd3a05971b90f7c7544084d76c..8157c9fcc1978c632a32f1930af56cf113276bcc
100644
--- a/test/mjsunit/regress/regress-array-pop-deopt.js
+++ b/test/mjsunit/regress/regress-crbug-336148.js
@@ -27,15 +27,30 @@
// Flags: --allow-natives-syntax
-var o = [6,7,8,9];
-
-function f(b) {
- var v = o.pop() + b;
- return v;
+function f(o) {
+ var a = 1;
+ if (true) return o.v && a;
}
-assertEquals(10, f(1));
-assertEquals(9, f(1));
-assertEquals(8, f(1));
+f({});
+f({});
%OptimizeFunctionOnNextCall(f);
-assertEquals("61", f("1"));
+assertEquals(1, f({ v: 1 }));
+
+
+function f1() { return 1 && 2; };
+function f2() { return 1 || 2; };
+function f3() { return 0 && 2; };
+function f4() { return 0 || 2; };
+
+function test() {
+ assertEquals(2, f1());
+ assertEquals(1, f2());
+ assertEquals(0, f3());
+ assertEquals(2, f4());
+}
+
+test();
+test();
+[f1, f2, f3, f4].forEach(function(f) { %OptimizeFunctionOnNextCall(f); });
+test();
--
--
v8-dev mailing list
[email protected]
http://groups.google.com/group/v8-dev
---
You received this message because you are subscribed to the Google Groups "v8-dev" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
For more options, visit https://groups.google.com/groups/opt_out.
