Reviewers: Jakob,
Description:
Test and fix for polymorphic named call deoptimization.
The fix removes wrong simulates from the number branch of polymorphic
call/field access handling.
The change also fixes the same thing for polymorphic named field
access even thourgh the field access is probably safe in practice
(because it cannot deoptimize). It is better to keep all our simulates
in sync with full codegen.
[email protected]
BUG=
Please review this at https://codereview.chromium.org/166503002/
SVN Base: https://v8.googlecode.com/svn/branches/bleeding_edge
Affected files (+13, -15 lines):
M src/hydrogen.cc
A + test/mjsunit/regress/number-named-call-deopt.js
Index: src/hydrogen.cc
diff --git a/src/hydrogen.cc b/src/hydrogen.cc
index
d3d7b5837a0c5e3d9a09ba4a58ce9486773818e8..dc5f8313dbeba626aaf62c82f9b5bb0c4821bad8
100644
--- a/src/hydrogen.cc
+++ b/src/hydrogen.cc
@@ -5638,7 +5638,7 @@ void
HOptimizedGraphBuilder::HandlePolymorphicNamedFieldAccess(
smi_check = New<HIsSmiAndBranch>(
object, empty_smi_block, not_smi_block);
FinishCurrentBlock(smi_check);
- Goto(empty_smi_block, number_block);
+ GotoNoSimulate(empty_smi_block, number_block);
set_current_block(not_smi_block);
} else {
BuildCheckHeapObject(object);
@@ -5666,9 +5666,8 @@ void
HOptimizedGraphBuilder::HandlePolymorphicNamedFieldAccess(
FinishCurrentBlock(compare);
if (info.type()->Is(Type::Number())) {
- Goto(if_true, number_block);
+ GotoNoSimulate(if_true, number_block);
if_true = number_block;
- number_block->SetJoinId(ast_id);
}
set_current_block(if_true);
@@ -6844,7 +6843,7 @@ void
HOptimizedGraphBuilder::HandlePolymorphicCallNamed(
number_block = graph()->CreateBasicBlock();
FinishCurrentBlock(New<HIsSmiAndBranch>(
receiver, empty_smi_block, not_smi_block));
- Goto(empty_smi_block, number_block);
+ GotoNoSimulate(empty_smi_block, number_block);
set_current_block(not_smi_block);
} else {
BuildCheckHeapObject(receiver);
@@ -6869,9 +6868,8 @@ void
HOptimizedGraphBuilder::HandlePolymorphicCallNamed(
FinishCurrentBlock(compare);
if (info.type()->Is(Type::Number())) {
- Goto(if_true, number_block);
+ GotoNoSimulate(if_true, number_block);
if_true = number_block;
- number_block->SetJoinId(expr->id());
}
set_current_block(if_true);
Index: test/mjsunit/regress/number-named-call-deopt.js
diff --git a/test/mjsunit/regress/regress-634-debug.js
b/test/mjsunit/regress/number-named-call-deopt.js
similarity index 87%
copy from test/mjsunit/regress/regress-634-debug.js
copy to test/mjsunit/regress/number-named-call-deopt.js
index
17ca828c68cd4de35f6bf0608a980fe1adebb355..1598af12b4914aaab50171628c2d482351e09b84
100644
--- a/test/mjsunit/regress/regress-634-debug.js
+++ b/test/mjsunit/regress/number-named-call-deopt.js
@@ -27,15 +27,15 @@
// Flags: --allow-natives-syntax
-function f() {
- %SetAllocationTimeout(1, 0, false);
- a = new Array(0);
- assertEquals(0, a.length);
- assertEquals(0, a.length);
- %SetAllocationTimeout(-1, -1, true);
+function f(x, deopt, osr) {
+ var res = "result";
+ void(x.toString(10, deopt + 0));
+ if (osr) for (var i = 0; i < 100000; i++) { }
+ return res;
}
-f();
-f();
+f(4, 0, false);
+f(4, 0, false);
+f(4, 0, false);
%OptimizeFunctionOnNextCall(f);
-f();
+assertEquals("result", f(4, "deopt", true));
--
--
v8-dev mailing list
[email protected]
http://groups.google.com/group/v8-dev
---
You received this message because you are subscribed to the Google Groups "v8-dev" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
For more options, visit https://groups.google.com/groups/opt_out.
