Reviewers: Jakob,
Description:
Merged r19536 into 3.24 branch.
Don't eliminate loads with incompatible types or representations.
BUG=346343
LOG=N
[email protected]
Please review this at https://codereview.chromium.org/181403002/
SVN Base: https://v8.googlecode.com/svn/branches/3.24
Affected files (+15, -12 lines):
M src/hydrogen-load-elimination.cc
M src/version.cc
A + test/mjsunit/regress/regress-346343.js
Index: src/hydrogen-load-elimination.cc
diff --git a/src/hydrogen-load-elimination.cc
b/src/hydrogen-load-elimination.cc
index
56839b294891d218749744551358b0e8f063935d..0c7de851690ad98baa78d6a2aa8bc02821ef2d67
100644
--- a/src/hydrogen-load-elimination.cc
+++ b/src/hydrogen-load-elimination.cc
@@ -76,7 +76,9 @@ class HLoadEliminationTable : public ZoneObject {
FieldOf(l->access()),
l->object()->ActualValue()->id()));
HValue* result = load(l);
- if (result != instr) {
+ if (result != instr &&
+ result->type().Equals(instr->type()) &&
+ result->representation().Equals(instr->representation())) {
// The load can be replaced with a previous load or a value.
TRACE((" replace L%d -> v%d\n", instr->id(), result->id()));
instr->DeleteAndReplaceWith(result);
Index: src/version.cc
diff --git a/src/version.cc b/src/version.cc
index
2d09a43955e5a3806aff55f8b06270fa3950d47d..0e29237ecb6688e2daec2c7a7aa46b2ff62a49d3
100644
--- a/src/version.cc
+++ b/src/version.cc
@@ -35,7 +35,7 @@
#define MAJOR_VERSION 3
#define MINOR_VERSION 24
#define BUILD_NUMBER 35
-#define PATCH_LEVEL 3
+#define PATCH_LEVEL 4
// Use 1 for candidates and 0 otherwise.
// (Boolean macro values are not supported by all preprocessors.)
#define IS_CANDIDATE_VERSION 0
Index: test/mjsunit/regress/regress-346343.js
diff --git a/test/mjsunit/recursive-store-opt.js
b/test/mjsunit/regress/regress-346343.js
similarity index 90%
copy from test/mjsunit/recursive-store-opt.js
copy to test/mjsunit/regress/regress-346343.js
index
fb2649248dbabc642f864f671d0ce2273ad44bd7..e4c10663138db599a682880df98f3310e0754b63
100644
--- a/test/mjsunit/recursive-store-opt.js
+++ b/test/mjsunit/regress/regress-346343.js
@@ -27,15 +27,16 @@
// Flags: --allow-natives-syntax
-function g() {
- this.x = this;
+function f(o) {
+ for (var i = 1; i < 2; ++i) {
+ var y = o.y;
+ }
}
+f({y:1.1});
+f({y:1.1});
-function f() {
- return new g();
-}
-
-f();
-f();
-%OptimizeFunctionOnNextCall(f);
-f();
+function g(x) { f({z:x}); }
+g(1);
+g(2);
+%OptimizeFunctionOnNextCall(g);
+g(1);
--
--
v8-dev mailing list
[email protected]
http://groups.google.com/group/v8-dev
---
You received this message because you are subscribed to the Google Groups "v8-dev" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
For more options, visit https://groups.google.com/groups/opt_out.
