Reviewers: jarin, Jakob,
Message:
PTAL
Description:
Don't adopt the AST id from previous if id is none, since previous may have
mismatching expected stack height.
Additionally, harden merging of simulates after instructions with side
effects
and ensure there's a simulate before HEnterInlined.
Please review this at https://codereview.chromium.org/252583004/
SVN Base: https://v8.googlecode.com/svn/branches/bleeding_edge
Affected files (+31, -15 lines):
M src/hydrogen-removable-simulates.cc
A + test/mjsunit/regress/regress-lazy-deopt-inlining2.js
Index: src/hydrogen-removable-simulates.cc
diff --git a/src/hydrogen-removable-simulates.cc
b/src/hydrogen-removable-simulates.cc
index
f952832431c124dcda6079a941947ad9cd7ed389..e65ba89cc413cd441638ffc9f224ebdfa8d7a1ae
100644
--- a/src/hydrogen-removable-simulates.cc
+++ b/src/hydrogen-removable-simulates.cc
@@ -41,14 +41,17 @@ void HMergeRemovableSimulatesPhase::Run() {
bool first = true;
for (HInstructionIterator it(block); !it.Done(); it.Advance()) {
HInstruction* current = it.Current();
+ if (current->IsEnterInlined()) {
+ // Ensure there's a non-foldable HSimulate before an HEnterInlined
to
+ // avoid folding across HEnterInlined.
+ ASSERT(!HSimulate::cast(current->previous())->
+ is_candidate_for_removal());
+ }
if (current->IsLeaveInlined()) {
- // Never fold simulates from inlined environments into simulates
- // in the outer environment.
- // (Before each HEnterInlined, there is a non-foldable HSimulate
- // anyway, so we get the barrier in the other direction for free.)
- // Simply remove all accumulated simulates without merging. This
- // is safe because simulates after instructions with side effects
- // are never added to the merge list.
+ // Never fold simulates from inlined environments into simulates
in the
+ // outer environment. Simply remove all accumulated simulates
without
+ // merging. This is safe because simulates after instructions with
side
+ // effects are never added to the merge list.
while (!mergelist.is_empty()) {
mergelist.RemoveLast()->DeleteAndReplaceWith(NULL);
}
@@ -70,13 +73,26 @@ void HMergeRemovableSimulatesPhase::Run() {
continue;
}
HSimulate* current_simulate = HSimulate::cast(current);
- if ((current_simulate->previous()->HasObservableSideEffects() &&
- !current_simulate->next()->IsSimulate()) ||
- !current_simulate->is_candidate_for_removal()) {
- // This simulate is not suitable for folding.
- // Fold the ones accumulated so far.
+ if (!current_simulate->is_candidate_for_removal()) {
+ current_simulate->MergeWith(&mergelist);
+ } else if (current_simulate->ast_id().IsNone()) {
+ ASSERT(current_simulate->next()->IsEnterInlined());
+ if (!mergelist.is_empty()) {
+ HSimulate* last = mergelist.RemoveLast();
+ last->MergeWith(&mergelist);
+ }
+ } else if (current_simulate->previous()->HasObservableSideEffects())
{
+ while (current_simulate->next()->IsSimulate()) {
+ HSimulate* next_simulate =
HSimulate::cast(current_simulate->next());
+ if (next_simulate->ast_id().IsNone()) {
+ ASSERT(next_simulate->next()->IsEnterInlined());
+ break;
+ }
+ mergelist.Add(current_simulate, zone());
+ current_simulate = next_simulate;
+ if (!current_simulate->is_candidate_for_removal()) break;
+ }
current_simulate->MergeWith(&mergelist);
- continue;
} else {
// Accumulate this simulate for folding later on.
mergelist.Add(current_simulate, zone());
Index: test/mjsunit/regress/regress-lazy-deopt-inlining2.js
diff --git a/test/mjsunit/regress/regress-lazy-deopt-inlining.js
b/test/mjsunit/regress/regress-lazy-deopt-inlining2.js
similarity index 85%
copy from test/mjsunit/regress/regress-lazy-deopt-inlining.js
copy to test/mjsunit/regress/regress-lazy-deopt-inlining2.js
index
6cda168dff5c948727d854c93d192c4fcac88a03..7b73b142322aeb4efb46768585437e8036c481e2
100644
--- a/test/mjsunit/regress/regress-lazy-deopt-inlining.js
+++ b/test/mjsunit/regress/regress-lazy-deopt-inlining2.js
@@ -6,10 +6,10 @@
"use strict";
function f1(d) {
- return 1 + f2(f3(d));
+ return 1 + f2(1, f3(d), d);
}
-function f2(v) { return v; }
+function f2(v0, v1, v2) { return v1; }
function f3(d) {
if (d) %DeoptimizeFunction(f1);
--
--
v8-dev mailing list
[email protected]
http://groups.google.com/group/v8-dev
---
You received this message because you are subscribed to the Google Groups "v8-dev" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
For more options, visit https://groups.google.com/d/optout.
