Reviewers: Benedikt Meurer,
Message:
PTAL
Description:
Check elimination now sets known successor branch of
HCompareObjectEqAndBranch
(correctness fix).
BUG=chromium:352058
LOG=N
Please review this at https://codereview.chromium.org/196383018/
SVN Base: https://v8.googlecode.com/svn/branches/bleeding_edge
Affected files (+41, -9 lines):
M src/hydrogen-check-elimination.cc
M src/hydrogen-instructions.h
M src/hydrogen-instructions.cc
A + test/mjsunit/regress/regress-crbug-352058.js
Index: src/hydrogen-check-elimination.cc
diff --git a/src/hydrogen-check-elimination.cc
b/src/hydrogen-check-elimination.cc
index
a7c45ac31cdd03a0aacc61a19419fd34cb8c9636..52a549299a24e7913a59aeb656e7e55c87c013fc
100644
--- a/src/hydrogen-check-elimination.cc
+++ b/src/hydrogen-check-elimination.cc
@@ -88,6 +88,10 @@ class HCheckTable : public ZoneObject {
ReduceCompareMap(HCompareMap::cast(instr));
break;
}
+ case HValue::kCompareObjectEqAndBranch: {
+
ReduceCompareObjectEqAndBranch(HCompareObjectEqAndBranch::cast(instr));
+ break;
+ }
case HValue::kTransitionElementsKind: {
ReduceTransitionElementsKind(
HTransitionElementsKind::cast(instr));
@@ -479,6 +483,23 @@ class HCheckTable : public ZoneObject {
instr->block()->MarkSuccEdgeUnreachable(unreachable_succ);
}
+ void ReduceCompareObjectEqAndBranch(HCompareObjectEqAndBranch* instr) {
+ MapSet maps_left = FindMaps(instr->left()->ActualValue());
+ if (maps_left == NULL) return;
+ MapSet maps_right = FindMaps(instr->right()->ActualValue());
+ if (maps_right == NULL) return;
+ MapSet intersection = maps_left->Intersect(maps_right, phase_->zone());
+ if (intersection->size() > 0) return;
+
+ TRACE(("Marking redundant CompareObjectEqAndBranch #%d at B%d as
false\n",
+ instr->id(), instr->block()->block_id()));
+ int succ = 1;
+ instr->set_known_successor_index(succ);
+
+ int unreachable_succ = 1 - succ;
+ instr->block()->MarkSuccEdgeUnreachable(unreachable_succ);
+ }
+
void ReduceTransitionElementsKind(HTransitionElementsKind* instr) {
MapSet maps = FindMaps(instr->object()->ActualValue());
// Can only learn more about an object that already has a known set of
maps.
Index: src/hydrogen-instructions.cc
diff --git a/src/hydrogen-instructions.cc b/src/hydrogen-instructions.cc
index
2b64f89ab28f7228f4ec2cbad69e6435b4132de1..b2f1708adec28fe4e915a0dc8d6baf310b938b5f
100644
--- a/src/hydrogen-instructions.cc
+++ b/src/hydrogen-instructions.cc
@@ -3098,6 +3098,10 @@ void
HCompareObjectEqAndBranch::PrintDataTo(StringStream* stream) {
bool HCompareObjectEqAndBranch::KnownSuccessorBlock(HBasicBlock** block) {
+ if (known_successor_index() != kNoKnownSuccessorIndex) {
+ *block = SuccessorAt(known_successor_index());
+ return true;
+ }
if (FLAG_fold_constants && left()->IsConstant() &&
right()->IsConstant()) {
*block = HConstant::cast(left())->DataEquals(HConstant::cast(right()))
? FirstSuccessor() : SecondSuccessor();
Index: src/hydrogen-instructions.h
diff --git a/src/hydrogen-instructions.h b/src/hydrogen-instructions.h
index
c70ac73ce569919a51438a739effd7517cfdb12c..5a6f4c2782f203e76b3e1d2b69397f1c197feaaf
100644
--- a/src/hydrogen-instructions.h
+++ b/src/hydrogen-instructions.h
@@ -4288,6 +4288,12 @@ class HCompareObjectEqAndBranch : public
HTemplateControlInstruction<2, 2> {
virtual bool KnownSuccessorBlock(HBasicBlock** block) V8_OVERRIDE;
+ static const int kNoKnownSuccessorIndex = -1;
+ int known_successor_index() const { return known_successor_index_; }
+ void set_known_successor_index(int known_successor_index) {
+ known_successor_index_ = known_successor_index;
+ }
+
HValue* left() { return OperandAt(0); }
HValue* right() { return OperandAt(1); }
@@ -4307,7 +4313,8 @@ class HCompareObjectEqAndBranch : public
HTemplateControlInstruction<2, 2> {
HCompareObjectEqAndBranch(HValue* left,
HValue* right,
HBasicBlock* true_target = NULL,
- HBasicBlock* false_target = NULL) {
+ HBasicBlock* false_target = NULL)
+ : known_successor_index_(kNoKnownSuccessorIndex) {
ASSERT(!left->IsConstant() ||
(!HConstant::cast(left)->HasInteger32Value() ||
HConstant::cast(left)->HasSmiValue()));
@@ -4319,6 +4326,8 @@ class HCompareObjectEqAndBranch : public
HTemplateControlInstruction<2, 2> {
SetSuccessorAt(0, true_target);
SetSuccessorAt(1, false_target);
}
+
+ int known_successor_index_;
};
Index: test/mjsunit/regress/regress-crbug-352058.js
diff --git a/test/mjsunit/regress/regress-347909.js
b/test/mjsunit/regress/regress-crbug-352058.js
similarity index 63%
copy from test/mjsunit/regress/regress-347909.js
copy to test/mjsunit/regress/regress-crbug-352058.js
index
90a8e6a759eab76afef1dc968c814bd9d324b147..e270d830074319a9d4631d95b60a37bc363876d5
100644
--- a/test/mjsunit/regress/regress-347909.js
+++ b/test/mjsunit/regress/regress-crbug-352058.js
@@ -2,17 +2,15 @@
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
-// Flags: --allow-natives-syntax
+// Flags: --allow-natives-syntax --check-elimination --stress-opt
-var a = {y:1.5};
-a.y = 0;
-var b = a.y;
-a.y = {};
-var d = 1;
+var v0 = this;
+var v2 = this;
function f() {
- d = 0;
- return {y: b};
+ v2 = [1.2, 2.3];
+ v0 = [12, 23];
}
+
f();
f();
%OptimizeFunctionOnNextCall(f);
--
--
v8-dev mailing list
[email protected]
http://groups.google.com/group/v8-dev
---
You received this message because you are subscribed to the Google Groups "v8-dev" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
For more options, visit https://groups.google.com/d/optout.
