Reviewers: Jakob,
Description:
Fix bug in constant folding object comparisons.
[email protected]
Please review this at https://codereview.chromium.org/195063002/
SVN Base: https://v8.googlecode.com/svn/branches/bleeding_edge
Affected files (+35, -30 lines):
M src/hydrogen-instructions.h
M src/hydrogen-instructions.cc
A + test/mjsunit/regress/regress-346587.js
Index: src/hydrogen-instructions.cc
diff --git a/src/hydrogen-instructions.cc b/src/hydrogen-instructions.cc
index
79c7964d15492ead5d3312a5ef53ad82770c1154..ba8d03b6f6f8f04839fee8c07dbfcc9a1c33943c
100644
--- a/src/hydrogen-instructions.cc
+++ b/src/hydrogen-instructions.cc
@@ -3056,7 +3056,7 @@ void
HCompareObjectEqAndBranch::PrintDataTo(StringStream* stream) {
bool HCompareObjectEqAndBranch::KnownSuccessorBlock(HBasicBlock** block) {
if (FLAG_fold_constants && left()->IsConstant() &&
right()->IsConstant()) {
- *block = HConstant::cast(left())->Equals(HConstant::cast(right()))
+ *block = HConstant::cast(left())->DataEquals(HConstant::cast(right()))
? FirstSuccessor() : SecondSuccessor();
return true;
}
Index: src/hydrogen-instructions.h
diff --git a/src/hydrogen-instructions.h b/src/hydrogen-instructions.h
index
c618fdfb544686061721f168ef1fed319f46419e..314abefb307ab02d7029feee19194a40142666ac
100644
--- a/src/hydrogen-instructions.h
+++ b/src/hydrogen-instructions.h
@@ -3584,15 +3584,6 @@ class HConstant V8_FINAL : public
HTemplateInstruction<0> {
return object_.IsInitialized() && object_ == other;
}
-#ifdef DEBUG
- virtual void Verify() V8_OVERRIDE { }
-#endif
-
- DECLARE_CONCRETE_INSTRUCTION(Constant)
-
- protected:
- virtual Range* InferRange(Zone* zone) V8_OVERRIDE;
-
virtual bool DataEquals(HValue* other) V8_OVERRIDE {
HConstant* other_constant = HConstant::cast(other);
if (has_int32_value_) {
@@ -3617,6 +3608,15 @@ class HConstant V8_FINAL : public
HTemplateInstruction<0> {
}
}
+#ifdef DEBUG
+ virtual void Verify() V8_OVERRIDE { }
+#endif
+
+ DECLARE_CONCRETE_INSTRUCTION(Constant)
+
+ protected:
+ virtual Range* InferRange(Zone* zone) V8_OVERRIDE;
+
private:
friend class HGraph;
HConstant(Handle<Object> handle, Representation r =
Representation::None());
@@ -4280,24 +4280,6 @@ class HCompareMinusZeroAndBranch V8_FINAL : public
HUnaryControlInstruction {
class HCompareObjectEqAndBranch : public HTemplateControlInstruction<2, 2>
{
public:
- HCompareObjectEqAndBranch(HValue* left,
- HValue* right,
- HBasicBlock* true_target = NULL,
- HBasicBlock* false_target = NULL) {
- // TODO(danno): make this private when the IfBuilder properly
constructs
- // control flow instructions.
- ASSERT(!left->IsConstant() ||
- (!HConstant::cast(left)->HasInteger32Value() ||
- HConstant::cast(left)->HasSmiValue()));
- ASSERT(!right->IsConstant() ||
- (!HConstant::cast(right)->HasInteger32Value() ||
- HConstant::cast(right)->HasSmiValue()));
- SetOperandAt(0, left);
- SetOperandAt(1, right);
- SetSuccessorAt(0, true_target);
- SetSuccessorAt(1, false_target);
- }
-
DECLARE_INSTRUCTION_FACTORY_P2(HCompareObjectEqAndBranch, HValue*,
HValue*);
DECLARE_INSTRUCTION_FACTORY_P4(HCompareObjectEqAndBranch, HValue*,
HValue*,
HBasicBlock*, HBasicBlock*);
@@ -4318,6 +4300,25 @@ class HCompareObjectEqAndBranch : public
HTemplateControlInstruction<2, 2> {
}
DECLARE_CONCRETE_INSTRUCTION(CompareObjectEqAndBranch)
+
+ private:
+ HCompareObjectEqAndBranch(HValue* left,
+ HValue* right,
+ HBasicBlock* true_target = NULL,
+ HBasicBlock* false_target = NULL) {
+ // TODO(danno): make this private when the IfBuilder properly
constructs
+ // control flow instructions.
+ ASSERT(!left->IsConstant() ||
+ (!HConstant::cast(left)->HasInteger32Value() ||
+ HConstant::cast(left)->HasSmiValue()));
+ ASSERT(!right->IsConstant() ||
+ (!HConstant::cast(right)->HasInteger32Value() ||
+ HConstant::cast(right)->HasSmiValue()));
+ SetOperandAt(0, left);
+ SetOperandAt(1, right);
+ SetSuccessorAt(0, true_target);
+ SetSuccessorAt(1, false_target);
+ }
};
Index: test/mjsunit/regress/regress-346587.js
diff --git a/test/mjsunit/regress/regress-347906.js
b/test/mjsunit/regress/regress-346587.js
similarity index 65%
copy from test/mjsunit/regress/regress-347906.js
copy to test/mjsunit/regress/regress-346587.js
index
c751618928c93015679087ee1b500637657aa341..40e3ac116cdfd9984a7ac07bf09f357bc9e03506
100644
--- a/test/mjsunit/regress/regress-347906.js
+++ b/test/mjsunit/regress/regress-346587.js
@@ -2,10 +2,14 @@
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
-// Flags: --allow-natives-syntax --harmony
+// Flags: --fold-constants --allow-natives-syntax
+
+function bar(obj) {
+ assertTrue(obj.x === 'baz');
+}
function foo() {
- return Math.clz32(12.34);
+ bar({ x : 'baz' });
}
foo();
--
--
v8-dev mailing list
[email protected]
http://groups.google.com/group/v8-dev
---
You received this message because you are subscribed to the Google Groups "v8-dev" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
For more options, visit https://groups.google.com/d/optout.
