Reviewers: Benedikt Meurer,
Description:
Fix ArrayShift hydrogen support
BUG=chromium:374838
LOG=y
[email protected]
Please review this at https://codereview.chromium.org/299713003/
SVN Base: https://v8.googlecode.com/svn/branches/bleeding_edge
Affected files (+10, -13 lines):
M src/hydrogen.cc
M src/hydrogen-instructions.h
A + test/mjsunit/regress/regress-crbug-374838.js
Index: src/hydrogen-instructions.h
diff --git a/src/hydrogen-instructions.h b/src/hydrogen-instructions.h
index
918229b1ae11f8e9141944139fdac15f0f7c813d..cf3497f20d3a39ea321ae8ba49a4e18a153652cf
100644
--- a/src/hydrogen-instructions.h
+++ b/src/hydrogen-instructions.h
@@ -7123,6 +7123,7 @@ class HArrayShift V8_FINAL : public
HTemplateInstruction<2> {
: kind_(kind) {
SetOperandAt(0, context);
SetOperandAt(1, object);
+ SetChangesFlag(kArrayLengths);
SetChangesFlag(kNewSpacePromotion);
set_representation(Representation::Tagged());
if (IsFastSmiOrObjectElementsKind(kind)) {
Index: src/hydrogen.cc
diff --git a/src/hydrogen.cc b/src/hydrogen.cc
index
40386aaaae26882cc865f7be039b93fbb627b552..b296b9372379bf8bcfc91809d7750d0d9207c03d
100644
--- a/src/hydrogen.cc
+++ b/src/hydrogen.cc
@@ -7927,10 +7927,6 @@ bool
HOptimizedGraphBuilder::TryInlineBuiltinMethodCall(
return true;
}
case kArrayShift: {
- // Something in here seems to be causing crbug.com/374838.
- // TODO(bmeurer): Investigate the problem and re-enable this code.
- return false;
-
if (receiver_map.is_null()) return false;
if (receiver_map->instance_type() != JS_ARRAY_TYPE) return false;
ElementsKind kind = receiver_map->elements_kind();
Index: test/mjsunit/regress/regress-crbug-374838.js
diff --git a/test/mjsunit/regress/regress-361608.js
b/test/mjsunit/regress/regress-crbug-374838.js
similarity index 57%
copy from test/mjsunit/regress/regress-361608.js
copy to test/mjsunit/regress/regress-crbug-374838.js
index
b3cc90cfd4b06afb3c7424758e23f91d685e3aa2..614b4d9a877fb3b52fe920c74e4ea8c1d19fad93
100644
--- a/test/mjsunit/regress/regress-361608.js
+++ b/test/mjsunit/regress/regress-crbug-374838.js
@@ -4,17 +4,17 @@
// Flags: --allow-natives-syntax
-function f() {};
-int_array = [1];
-
function foo() {
- var x;
- for (var i = -1; i < 0; i++) {
- x = int_array[i + 1];
- f(function() { x = i; });
+ var a = [0];
+ result = 0;
+ for (var i = 0; i < 4; i++) {
+ result += a.length;
+ a.shift();
}
+ return result;
}
-foo();
+assertEquals(1, foo());
+assertEquals(1, foo());
%OptimizeFunctionOnNextCall(foo);
-foo();
+assertEquals(1, foo());
--
--
v8-dev mailing list
[email protected]
http://groups.google.com/group/v8-dev
---
You received this message because you are subscribed to the Google Groups "v8-dev" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
For more options, visit https://groups.google.com/d/optout.
