Revision: 19798
Author: [email protected]
Date: Tue Mar 11 13:34:01 2014 UTC
Log: Fix bug in constant folding object comparisons.
[email protected]
Review URL: https://codereview.chromium.org/195063002
http://code.google.com/p/v8/source/detail?r=19798
Added:
/branches/bleeding_edge/test/mjsunit/regress/regress-346587.js
Modified:
/branches/bleeding_edge/src/hydrogen-instructions.cc
/branches/bleeding_edge/src/hydrogen-instructions.h
=======================================
--- /dev/null
+++ /branches/bleeding_edge/test/mjsunit/regress/regress-346587.js Tue Mar
11 13:34:01 2014 UTC
@@ -0,0 +1,18 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --fold-constants --allow-natives-syntax
+
+function bar(obj) {
+ assertTrue(obj.x === 'baz');
+}
+
+function foo() {
+ bar({ x : 'baz' });
+}
+
+foo();
+foo();
+%OptimizeFunctionOnNextCall(foo);
+foo();
=======================================
--- /branches/bleeding_edge/src/hydrogen-instructions.cc Mon Mar 10
15:06:54 2014 UTC
+++ /branches/bleeding_edge/src/hydrogen-instructions.cc Tue Mar 11
13:34:01 2014 UTC
@@ -3056,7 +3056,7 @@
bool HCompareObjectEqAndBranch::KnownSuccessorBlock(HBasicBlock** block) {
if (FLAG_fold_constants && left()->IsConstant() &&
right()->IsConstant()) {
- *block = HConstant::cast(left())->Equals(HConstant::cast(right()))
+ *block = HConstant::cast(left())->DataEquals(HConstant::cast(right()))
? FirstSuccessor() : SecondSuccessor();
return true;
}
=======================================
--- /branches/bleeding_edge/src/hydrogen-instructions.h Tue Mar 11 11:57:27
2014 UTC
+++ /branches/bleeding_edge/src/hydrogen-instructions.h Tue Mar 11 13:34:01
2014 UTC
@@ -3583,15 +3583,6 @@
bool EqualsUnique(Unique<Object> other) const {
return object_.IsInitialized() && object_ == other;
}
-
-#ifdef DEBUG
- virtual void Verify() V8_OVERRIDE { }
-#endif
-
- DECLARE_CONCRETE_INSTRUCTION(Constant)
-
- protected:
- virtual Range* InferRange(Zone* zone) V8_OVERRIDE;
virtual bool DataEquals(HValue* other) V8_OVERRIDE {
HConstant* other_constant = HConstant::cast(other);
@@ -3617,6 +3608,15 @@
}
}
+#ifdef DEBUG
+ virtual void Verify() V8_OVERRIDE { }
+#endif
+
+ DECLARE_CONCRETE_INSTRUCTION(Constant)
+
+ protected:
+ virtual Range* InferRange(Zone* zone) V8_OVERRIDE;
+
private:
friend class HGraph;
HConstant(Handle<Object> handle, Representation r =
Representation::None());
@@ -4280,24 +4280,6 @@
class HCompareObjectEqAndBranch : public HTemplateControlInstruction<2, 2>
{
public:
- HCompareObjectEqAndBranch(HValue* left,
- HValue* right,
- HBasicBlock* true_target = NULL,
- HBasicBlock* false_target = NULL) {
- // TODO(danno): make this private when the IfBuilder properly
constructs
- // control flow instructions.
- ASSERT(!left->IsConstant() ||
- (!HConstant::cast(left)->HasInteger32Value() ||
- HConstant::cast(left)->HasSmiValue()));
- ASSERT(!right->IsConstant() ||
- (!HConstant::cast(right)->HasInteger32Value() ||
- HConstant::cast(right)->HasSmiValue()));
- SetOperandAt(0, left);
- SetOperandAt(1, right);
- SetSuccessorAt(0, true_target);
- SetSuccessorAt(1, false_target);
- }
-
DECLARE_INSTRUCTION_FACTORY_P2(HCompareObjectEqAndBranch, HValue*,
HValue*);
DECLARE_INSTRUCTION_FACTORY_P4(HCompareObjectEqAndBranch, HValue*,
HValue*,
HBasicBlock*, HBasicBlock*);
@@ -4318,6 +4300,23 @@
}
DECLARE_CONCRETE_INSTRUCTION(CompareObjectEqAndBranch)
+
+ private:
+ HCompareObjectEqAndBranch(HValue* left,
+ HValue* right,
+ HBasicBlock* true_target = NULL,
+ HBasicBlock* false_target = NULL) {
+ ASSERT(!left->IsConstant() ||
+ (!HConstant::cast(left)->HasInteger32Value() ||
+ HConstant::cast(left)->HasSmiValue()));
+ ASSERT(!right->IsConstant() ||
+ (!HConstant::cast(right)->HasInteger32Value() ||
+ HConstant::cast(right)->HasSmiValue()));
+ SetOperandAt(0, left);
+ SetOperandAt(1, right);
+ SetSuccessorAt(0, true_target);
+ SetSuccessorAt(1, false_target);
+ }
};
--
--
v8-dev mailing list
[email protected]
http://groups.google.com/group/v8-dev
---
You received this message because you are subscribed to the Google Groups "v8-dev" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
For more options, visit https://groups.google.com/d/optout.
