Reviewers: Jakob,
Description:
Merged r19031 into 3.22 branch.
Fix short-circuiting logical and/or in HOptimizedGraphBuilder.
BUG=336148
LOG=N
[email protected]
Please review this at https://codereview.chromium.org/160543002/
SVN Base: https://v8.googlecode.com/svn/branches/3.22
Affected files (+32, -15 lines):
M src/hydrogen.cc
M src/version.cc
A + test/mjsunit/regress/regress-crbug-336148.js
Index: src/hydrogen.cc
diff --git a/src/hydrogen.cc b/src/hydrogen.cc
index
9587dd3440e749ae8f9a9f847827daa5526d338e..0a3623051e6a4b87e12086674482e61bdf7ef5b7
100644
--- a/src/hydrogen.cc
+++ b/src/hydrogen.cc
@@ -8050,11 +8050,14 @@ void
HOptimizedGraphBuilder::VisitLogicalExpression(BinaryOperation* expr) {
ASSERT(current_block() != NULL);
HValue* left_value = Top();
- if (left_value->IsConstant()) {
- HConstant* left_constant = HConstant::cast(left_value);
- if ((is_logical_and && left_constant->BooleanValue()) ||
- (!is_logical_and && !left_constant->BooleanValue())) {
- Drop(1); // left_value.
+ // Short-circuit left values that always evaluate to the same boolean
value.
+ if (expr->left()->ToBooleanIsTrue() ||
expr->left()->ToBooleanIsFalse()) {
+ // l (evals true) && r -> r
+ // l (evals true) || r -> l
+ // l (evals false) && r -> l
+ // l (evals false) || r -> r
+ if (is_logical_and == expr->left()->ToBooleanIsTrue()) {
+ Drop(1);
CHECK_ALIVE(VisitForValue(expr->right()));
}
return ast_context()->ReturnValue(Pop());
Index: src/version.cc
diff --git a/src/version.cc b/src/version.cc
index
cecdee4e059369ad5c33f4a345f5288d18f40ff7..b84db71329c8179a51e77e6d1bd2dc3e3221a8da
100644
--- a/src/version.cc
+++ b/src/version.cc
@@ -35,7 +35,7 @@
#define MAJOR_VERSION 3
#define MINOR_VERSION 22
#define BUILD_NUMBER 24
-#define PATCH_LEVEL 20
+#define PATCH_LEVEL 21
// Use 1 for candidates and 0 otherwise.
// (Boolean macro values are not supported by all preprocessors.)
#define IS_CANDIDATE_VERSION 0
Index: test/mjsunit/regress/regress-crbug-336148.js
diff --git a/test/mjsunit/regress/regress-334708.js
b/test/mjsunit/regress/regress-crbug-336148.js
similarity index 77%
copy from test/mjsunit/regress/regress-334708.js
copy to test/mjsunit/regress/regress-crbug-336148.js
index
f0291bbdab61128baad9df89457d045b66644f1b..8157c9fcc1978c632a32f1930af56cf113276bcc
100644
--- a/test/mjsunit/regress/regress-334708.js
+++ b/test/mjsunit/regress/regress-crbug-336148.js
@@ -27,16 +27,30 @@
// Flags: --allow-natives-syntax
-function foo(x, y) {
- return Math.floor(x / y);
+function f(o) {
+ var a = 1;
+ if (true) return o.v && a;
}
-function bar(x, y) {
- return foo(x + 1, y + 1);
-}
+f({});
+f({});
+%OptimizeFunctionOnNextCall(f);
+assertEquals(1, f({ v: 1 }));
+
-foo(16, "4");
+function f1() { return 1 && 2; };
+function f2() { return 1 || 2; };
+function f3() { return 0 && 2; };
+function f4() { return 0 || 2; };
+
+function test() {
+ assertEquals(2, f1());
+ assertEquals(1, f2());
+ assertEquals(0, f3());
+ assertEquals(2, f4());
+}
-bar(64, 2);
-%OptimizeFunctionOnNextCall(bar);
-bar(64, 2);
+test();
+test();
+[f1, f2, f3, f4].forEach(function(f) { %OptimizeFunctionOnNextCall(f); });
+test();
--
--
v8-dev mailing list
[email protected]
http://groups.google.com/group/v8-dev
---
You received this message because you are subscribed to the Google Groups "v8-dev" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
For more options, visit https://groups.google.com/groups/opt_out.
