Reviewers: Toon Verwaest,
Message:
This should fix the issue in VisitCall where the immutable
property inlining patch ends up returning an HConstant for a
JSFunction and VisitCall assumes types->length() > 0 in this
situation.
I also have the immutable property inlining patch separately
implemented in BuildLoadNamedField already since it was required to trigger
the
case in VisitCall.
Description:
Populate receiver types when there is no type feedback
When there is no type feedback yet, ComputeReceiverTypes
should still populate the SmallMapList when the receiver
is a HConstant.
BUG=
[email protected]
Please review this at https://codereview.chromium.org/230363003/
SVN Base: https://github.com/v8/v8.git@master
Affected files (+23, -6 lines):
M src/hydrogen.cc
Index: src/hydrogen.cc
diff --git a/src/hydrogen.cc b/src/hydrogen.cc
index
8ce614fd660484efbc59f05e954b078d30acd6a9..2c32d7970e19fd1e0089650b25512e9cabc6fff1
100644
--- a/src/hydrogen.cc
+++ b/src/hydrogen.cc
@@ -5807,13 +5807,26 @@ void
HOptimizedGraphBuilder::HandlePolymorphicNamedFieldAccess(
static bool ComputeReceiverTypes(Expression* expr,
HValue* receiver,
SmallMapList** t,
+ PropertyAccessType access_type,
Zone* zone) {
SmallMapList* types = expr->GetReceiverTypes();
*t = types;
bool monomorphic = expr->IsMonomorphic();
- if (types != NULL && receiver->HasMonomorphicJSObjectType()) {
- Map* root_map = receiver->GetMonomorphicJSObjectMap()->FindRootMap();
- types->FilterForPossibleTransitions(root_map);
+ Isolate* isolate = zone->isolate();
+ if (types != NULL) {
+ if (receiver->HasMonomorphicJSObjectType()) {
+ Map* root_map = receiver->GetMonomorphicJSObjectMap()->FindRootMap();
+ types->FilterForPossibleTransitions(root_map);
+ } else if (types->is_empty() &&
+ receiver->IsConstant() &&
+ HConstant::cast(receiver)->handle(isolate)->IsJSObject()) {
+ Handle<Map> map(Handle<JSObject>::cast(
+ HConstant::cast(receiver)->handle(isolate))->map());
+
+ if (access_type != STORE || !map->is_observed()) {
+ types->Add(map, zone);
+ }
+ }
monomorphic = types->length() == 1;
}
return monomorphic && CanInlinePropertyAccess(
@@ -6520,7 +6533,11 @@ HValue*
HOptimizedGraphBuilder::HandleKeyedElementAccess(
HInstruction* instr = NULL;
SmallMapList* types;
- bool monomorphic = ComputeReceiverTypes(expr, obj, &types, zone());
+ bool monomorphic = ComputeReceiverTypes(expr,
+ obj,
+ &types,
+ access_type,
+ zone());
bool force_generic = false;
if (access_type == STORE &&
@@ -6659,7 +6676,7 @@ HInstruction*
HOptimizedGraphBuilder::BuildNamedAccess(
HValue* value,
bool is_uninitialized) {
SmallMapList* types;
- ComputeReceiverTypes(expr, object, &types, zone());
+ ComputeReceiverTypes(expr, object, &types, access, zone());
ASSERT(types != NULL);
if (types->length() > 0) {
@@ -7975,7 +7992,7 @@ void HOptimizedGraphBuilder::VisitCall(Call* expr) {
HValue* receiver = Top();
SmallMapList* types;
- ComputeReceiverTypes(expr, receiver, &types, zone());
+ ComputeReceiverTypes(expr, receiver, &types, LOAD, zone());
if (prop->key()->IsPropertyName() && types->length() > 0) {
Handle<String> name = prop->key()->AsLiteral()->AsPropertyName();
--
--
v8-dev mailing list
[email protected]
http://groups.google.com/group/v8-dev
---
You received this message because you are subscribed to the Google Groups "v8-dev" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
For more options, visit https://groups.google.com/d/optout.
