Reviewers: Jakob,
Description:
Fix handling of polymorphic array accesses with constant index
[email protected]
BUG=chromium:351319
Please review this at https://codereview.chromium.org/196353004/
SVN Base: https://v8.googlecode.com/svn/branches/bleeding_edge
Affected files (+25, -16 lines):
M src/hydrogen-instructions.cc
A + test/mjsunit/regress/regress-351319.js
Index: src/hydrogen-instructions.cc
diff --git a/src/hydrogen-instructions.cc b/src/hydrogen-instructions.cc
index
c93bc1144af36376167cbac155e664ec57cda72c..cd9186c00106b0a23fcc96adcb78ad5265c9454e
100644
--- a/src/hydrogen-instructions.cc
+++ b/src/hydrogen-instructions.cc
@@ -1432,20 +1432,32 @@ void HTypeof::PrintDataTo(StringStream* stream) {
}
+static bool CanRepresentationContainDouble(Representation rep, double
value) {
+ if (rep.IsDouble() ||
rep.is_more_general_than(Representation::Double())) {
+ return true;
+ }
+ if (IsInt32Double(value)) {
+ if (rep.IsInteger32()) return true;
+ if (rep.IsSmi()) return Smi::IsValid(static_cast<int32_t>(value));
+ }
+ return false;
+}
+
+
HInstruction* HForceRepresentation::New(Zone* zone, HValue* context,
- HValue* value, Representation required_representation) {
+ HValue* value, Representation representation) {
if (FLAG_fold_constants && value->IsConstant()) {
HConstant* c = HConstant::cast(value);
if (c->HasNumberValue()) {
double double_res = c->DoubleValue();
- if (IsInt32Double(double_res)) {
+ if (CanRepresentationContainDouble(representation, double_res)) {
return HConstant::New(zone, context,
static_cast<int32_t>(double_res),
- required_representation);
+ representation);
}
}
}
- return new(zone) HForceRepresentation(value, required_representation);
+ return new(zone) HForceRepresentation(value, representation);
}
Index: test/mjsunit/regress/regress-351319.js
diff --git a/test/mjsunit/regress/regress-334708.js
b/test/mjsunit/regress/regress-351319.js
similarity index 88%
copy from test/mjsunit/regress/regress-334708.js
copy to test/mjsunit/regress/regress-351319.js
index
f0291bbdab61128baad9df89457d045b66644f1b..a2afbb6a98adb01eee37fe7f8c6472d300020e2b
100644
--- a/test/mjsunit/regress/regress-334708.js
+++ b/test/mjsunit/regress/regress-351319.js
@@ -27,16 +27,13 @@
// Flags: --allow-natives-syntax
-function foo(x, y) {
- return Math.floor(x / y);
+function __f_0(a, base) {
+ a[base] = 1;
+ a[base] = -1749557862;
}
-
-function bar(x, y) {
- return foo(x + 1, y + 1);
-}
-
-foo(16, "4");
-
-bar(64, 2);
-%OptimizeFunctionOnNextCall(bar);
-bar(64, 2);
+var __v_0 = new Array(1024);
+var __v_1 = new Array(128);
+__f_0(__v_0, 1);
+__f_0(__v_1, -2);
+%OptimizeFunctionOnNextCall(__f_0);
+__f_0(__v_0, -2);
--
--
v8-dev mailing list
[email protected]
http://groups.google.com/group/v8-dev
---
You received this message because you are subscribed to the Google Groups "v8-dev" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
For more options, visit https://groups.google.com/d/optout.
