Reviewers: Jakob,
Description:
Binary operation deoptimization fix.
[email protected]
BUG=
Please review this at https://codereview.chromium.org/132453009/
SVN Base: https://v8.googlecode.com/svn/branches/bleeding_edge
Affected files (+31, -20 lines):
M src/hydrogen.h
M src/hydrogen.cc
A + test/mjsunit/regress/binop-in-effect-context-deopt.js
Index: src/hydrogen.cc
diff --git a/src/hydrogen.cc b/src/hydrogen.cc
index
1593301e2ec715f7e67f0bfb17446f9941ad9fb0..0657e7ac18c1ad98f8339ad2786510e1401a8087
100644
--- a/src/hydrogen.cc
+++ b/src/hydrogen.cc
@@ -6066,7 +6066,8 @@ void
HOptimizedGraphBuilder::HandleCompoundAssignment(Assignment* expr) {
HValue* right = Pop();
HValue* left = Pop();
- Push(BuildBinaryOperation(operation, left, right));
+ Push(BuildBinaryOperation(operation, left, right, false));
+
BuildStore(expr, prop, expr->id(),
expr->AssignmentId(), expr->IsUninitialized());
} else {
@@ -9045,7 +9046,8 @@ HValue* HGraphBuilder::TruncateToNumber(HValue*
value, Type** expected) {
HValue* HOptimizedGraphBuilder::BuildBinaryOperation(
BinaryOperation* expr,
HValue* left,
- HValue* right) {
+ HValue* right,
+ bool is_effect) {
Type* left_type = expr->left()->bounds().lower;
Type* right_type = expr->right()->bounds().lower;
Type* result_type = expr->bounds().lower;
@@ -9069,9 +9071,13 @@ HValue* HOptimizedGraphBuilder::BuildBinaryOperation(
// after phis, which are the result of BuildBinaryOperation when we
// inlined some complex subgraph.
if (result->HasObservableSideEffects() || result->IsPhi()) {
- Push(result);
- Add<HSimulate>(expr->id(), REMOVABLE_SIMULATE);
- Drop(1);
+ if (is_effect) {
+ Add<HSimulate>(expr->id(), REMOVABLE_SIMULATE);
+ } else {
+ Push(result);
+ Add<HSimulate>(expr->id(), REMOVABLE_SIMULATE);
+ Drop(1);
+ }
}
return result;
}
@@ -9451,7 +9457,8 @@ void
HOptimizedGraphBuilder::VisitArithmeticExpression(BinaryOperation* expr) {
SetSourcePosition(expr->position());
HValue* right = Pop();
HValue* left = Pop();
- HValue* result = BuildBinaryOperation(expr, left, right);
+ HValue* result =
+ BuildBinaryOperation(expr, left, right, ast_context()->IsEffect());
if (FLAG_emit_opt_code_positions && result->IsBinaryOperation()) {
HBinaryOperation::cast(result)->SetOperandPositions(
zone(), expr->left()->position(), expr->right()->position());
Index: src/hydrogen.h
diff --git a/src/hydrogen.h b/src/hydrogen.h
index
7eb2c84f024eb5efa79696eb43513a05cf45f60a..76f9ca3eddb6198eb078f5cf96eeab9b8150ce9a
100644
--- a/src/hydrogen.h
+++ b/src/hydrogen.h
@@ -2420,7 +2420,8 @@ class HOptimizedGraphBuilder : public HGraphBuilder,
public AstVisitor {
HValue* index);
HValue* BuildBinaryOperation(BinaryOperation* expr,
HValue* left,
- HValue* right);
+ HValue* right,
+ bool is_effect);
HInstruction* BuildIncrement(bool returns_original_input,
CountOperation* expr);
HInstruction* BuildLoadKeyedGeneric(HValue* object,
Index: test/mjsunit/regress/binop-in-effect-context-deopt.js
diff --git a/test/mjsunit/compiler/regress-rep-change.js
b/test/mjsunit/regress/binop-in-effect-context-deopt.js
similarity index 84%
copy from test/mjsunit/compiler/regress-rep-change.js
copy to test/mjsunit/regress/binop-in-effect-context-deopt.js
index
c8a0983c44c7ff00709d4c00a359fc7fd2ac89b7..d18cee375fa87ca9cc2364490e24e4812d3e2852
100644
--- a/test/mjsunit/compiler/regress-rep-change.js
+++ b/test/mjsunit/regress/binop-in-effect-context-deopt.js
@@ -27,21 +27,24 @@
// Flags: --allow-natives-syntax
-// Regression test for the case where a phi has two input operands with
-// the same value.
+(function BinaryOpInEffectContextDeoptimization() {
+ function deopt_f() {
+ %DeoptimizeFunction(f);
+ return "dummy";
+ }
-function test(start) {
- if (true) {
- for (var i = start; i < 10; i++) { }
+ function h() {
+ return { toString : deopt_f };
}
- for (var i = start; i < 10; i++) { }
-}
-var n = 3;
+ function g(x) {
+ }
-for (var i = 0; i < n; ++i) {
- test(0);
-}
+ function f() {
+ return g(void(h() + ""));
+ };
-%OptimizeFunctionOnNextCall(test);
-test(0);
+ f();
+ %OptimizeFunctionOnNextCall(f);
+ f();
+})();
--
--
v8-dev mailing list
[email protected]
http://groups.google.com/group/v8-dev
---
You received this message because you are subscribed to the Google Groups "v8-dev" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
For more options, visit https://groups.google.com/groups/opt_out.
