Revision: 19584
Author: [email protected]
Date: Thu Feb 27 15:12:12 2014 UTC
Log: Handle arguments objects in frame when materializing arguments
[email protected]
BUG=347262
Review URL: https://codereview.chromium.org/177293009
http://code.google.com/p/v8/source/detail?r=19584
Added:
/branches/bleeding_edge/test/mjsunit/regress/regress-347262.js
Modified:
/branches/bleeding_edge/src/deoptimizer.cc
/branches/bleeding_edge/src/deoptimizer.h
=======================================
--- /dev/null
+++ /branches/bleeding_edge/test/mjsunit/regress/regress-347262.js Thu Feb
27 15:12:12 2014 UTC
@@ -0,0 +1,62 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --allow-natives-syntax
+
+(function ArgumentsObjectWithOtherArgumentsInFrame() {
+ function g() {
+ return g.arguments;
+ }
+
+ function f(x) {
+ g();
+ return arguments[0];
+ }
+ f();
+ f();
+ %OptimizeFunctionOnNextCall(f);
+ f();
+})();
+
+
+(function ArgumentsObjectWithOtherArgumentsDeopt() {
+ function g(y) {
+ y.o2 = 2;
+ return g.arguments;
+ }
+
+ function f(x) {
+ var o1 = { o2 : 1 };
+ var a = g(o1);
+ o1.o2 = 3;
+ return arguments[0] + a[0].o2;
+ }
+ f(0);
+ f(0);
+ %OptimizeFunctionOnNextCall(f);
+ assertEquals(3, f(0));
+})();
=======================================
--- /branches/bleeding_edge/src/deoptimizer.cc Thu Feb 13 16:09:28 2014 UTC
+++ /branches/bleeding_edge/src/deoptimizer.cc Thu Feb 27 15:12:12 2014 UTC
@@ -2998,8 +2998,7 @@
}
case Translation::ARGUMENTS_OBJECT:
- // This can be only emitted for local slots not for argument slots.
- break;
+ return SlotRef::NewArgumentsObject(iterator->Next());
case Translation::CAPTURED_OBJECT: {
return SlotRef::NewDeferredObject(iterator->Next());
@@ -3049,7 +3048,7 @@
break;
}
- UNREACHABLE();
+ FATAL("We should never get here - unexpected deopt info.");
return SlotRef();
}
@@ -3129,9 +3128,8 @@
// the nested slots of captured objects
number_of_slots--;
SlotRef& slot = slot_refs_.last();
- if (slot.Representation() == SlotRef::DEFERRED_OBJECT) {
- number_of_slots += slot.DeferredObjectLength();
- }
+ ASSERT(slot.Representation() != SlotRef::ARGUMENTS_OBJECT);
+ number_of_slots += slot.GetChildrenCount();
if (slot.Representation() == SlotRef::DEFERRED_OBJECT ||
slot.Representation() == SlotRef::DUPLICATE_OBJECT) {
should_deopt = true;
@@ -3185,7 +3183,7 @@
return literal_;
default:
- UNREACHABLE();
+ FATAL("We should never get here - unexpected deopt info.");
return Handle<Object>::null();
}
}
@@ -3215,19 +3213,18 @@
previously_materialized_objects_->get(object_index), isolate);
materialized_objects_.Add(return_value);
- // Now need to skip all nested objects (and possibly read them from
- // the materialization store, too)
+ // Now need to skip all the nested objects (and possibly read them from
+ // the materialization store, too).
for (int i = 0; i < length; i++) {
SlotRef& slot = slot_refs_[current_slot_];
current_slot_++;
- // For nested deferred objects, we need to read its properties
- if (slot.Representation() == SlotRef::DEFERRED_OBJECT) {
- length += slot.DeferredObjectLength();
- }
+ // We need to read all the nested objects - add them to the
+ // number of objects we need to process.
+ length += slot.GetChildrenCount();
- // For nested deferred and duplicate objects, we need to put them into
- // our materialization array
+ // Put the nested deferred/duplicate objects into our materialization
+ // array.
if (slot.Representation() == SlotRef::DEFERRED_OBJECT ||
slot.Representation() == SlotRef::DUPLICATE_OBJECT) {
int nested_object_index = materialized_objects_.length();
@@ -3253,8 +3250,20 @@
case SlotRef::LITERAL: {
return slot.GetValue(isolate);
}
+ case SlotRef::ARGUMENTS_OBJECT: {
+ // We should never need to materialize an arguments object,
+ // but we still need to put something into the array
+ // so that the indexing is consistent.
+ materialized_objects_.Add(isolate->factory()->undefined_value());
+ int length = slot.GetChildrenCount();
+ for (int i = 0; i < length; ++i) {
+ // We don't need the argument, just ignore it
+ GetNext(isolate, lvl + 1);
+ }
+ return isolate->factory()->undefined_value();
+ }
case SlotRef::DEFERRED_OBJECT: {
- int length = slot.DeferredObjectLength();
+ int length = slot.GetChildrenCount();
ASSERT(slot_refs_[current_slot_].Representation() ==
SlotRef::LITERAL ||
slot_refs_[current_slot_].Representation() ==
SlotRef::TAGGED);
@@ -3323,7 +3332,7 @@
break;
}
- UNREACHABLE();
+ FATAL("We should never get here - unexpected deopt slot kind.");
return Handle<Object>::null();
}
=======================================
--- /branches/bleeding_edge/src/deoptimizer.h Thu Jan 30 10:33:53 2014 UTC
+++ /branches/bleeding_edge/src/deoptimizer.h Thu Feb 27 15:12:12 2014 UTC
@@ -794,7 +794,9 @@
// with the DeferredObjectLength() method
// (the SlotRefs of the nested objects follow
// this SlotRef in the depth-first order.)
- DUPLICATE_OBJECT // Duplicated object of a deferred object.
+ DUPLICATE_OBJECT, // Duplicated object of a deferred object.
+ ARGUMENTS_OBJECT // Arguments object - only used to keep indexing
+ // in sync, it should not be materialized.
};
SlotRef()
@@ -805,6 +807,13 @@
SlotRef(Isolate* isolate, Object* literal)
: literal_(literal, isolate), representation_(LITERAL) { }
+
+ static SlotRef NewArgumentsObject(int length) {
+ SlotRef slot;
+ slot.representation_ = ARGUMENTS_OBJECT;
+ slot.deferred_object_length_ = length;
+ return slot;
+ }
static SlotRef NewDeferredObject(int length) {
SlotRef slot;
@@ -822,7 +831,14 @@
return slot;
}
- int DeferredObjectLength() { return deferred_object_length_; }
+ int GetChildrenCount() {
+ if (representation_ == DEFERRED_OBJECT ||
+ representation_ == ARGUMENTS_OBJECT) {
+ return deferred_object_length_;
+ } else {
+ return 0;
+ }
+ }
int DuplicateObjectId() { return duplicate_object_id_; }
--
--
v8-dev mailing list
[email protected]
http://groups.google.com/group/v8-dev
---
You received this message because you are subscribed to the Google Groups "v8-dev" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
For more options, visit https://groups.google.com/groups/opt_out.
