Reviewers: Toon Verwaest, Hannes Payer,
Message:
Hey Toon,
Here's the fix for the load elimination bug.
PTAL
Description:
Don't eliminate loads with incompatible representations.
BUG=346343
LOG=y
Please review this at https://codereview.chromium.org/179553002/
SVN Base: https://v8.googlecode.com/svn/branches/bleeding_edge
Affected files (+9, -14 lines):
M src/hydrogen-load-elimination.cc
A + test/mjsunit/regress/regress-346343.js
Index: src/hydrogen-load-elimination.cc
diff --git a/src/hydrogen-load-elimination.cc
b/src/hydrogen-load-elimination.cc
index
222811678b4c8175fd027670f7e9d16d869dfa0c..b504291a66f4663d2e2f41b688585ea826b13e88
100644
--- a/src/hydrogen-load-elimination.cc
+++ b/src/hydrogen-load-elimination.cc
@@ -76,7 +76,8 @@ class HLoadEliminationTable : public ZoneObject {
FieldOf(l->access()),
l->object()->ActualValue()->id()));
HValue* result = load(l);
- if (result != instr) {
+ if (result != instr &&
+ result->representation().Equals(instr->representation())) {
// The load can be replaced with a previous load or a value.
TRACE((" replace L%d -> v%d\n", instr->id(), result->id()));
instr->DeleteAndReplaceWith(result);
Index: test/mjsunit/regress/regress-346343.js
diff --git a/test/mjsunit/recursive-store-opt.js
b/test/mjsunit/regress/regress-346343.js
similarity index 91%
copy from test/mjsunit/recursive-store-opt.js
copy to test/mjsunit/regress/regress-346343.js
index
fb2649248dbabc642f864f671d0ce2273ad44bd7..39117bcfd4547de7a0fd68ea4576d0fe87de4edc
100644
--- a/test/mjsunit/recursive-store-opt.js
+++ b/test/mjsunit/regress/regress-346343.js
@@ -25,17 +25,11 @@
// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
-// Flags: --allow-natives-syntax
-
-function g() {
- this.x = this;
-}
-
-function f() {
- return new g();
+function f(o) {
+ for (var i = 1; i < 2; ++i) {
+ var y = o.y;
+ }
}
-
-f();
-f();
-%OptimizeFunctionOnNextCall(f);
-f();
+f({y:1.1}, [1]);
+f({y:1.1}, [1]);
+for (var i = 0; i < 1000000; ++i) f({z:1});
--
--
v8-dev mailing list
[email protected]
http://groups.google.com/group/v8-dev
---
You received this message because you are subscribed to the Google Groups "v8-dev" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
For more options, visit https://groups.google.com/groups/opt_out.
