Revision: 21467
Author: [email protected]
Date: Fri May 23 14:02:08 2014 UTC
Log: Fix representation inference for mutable double boxes.
[email protected]
BUG=v8:3307
TEST=mjsunit/regress/regress-3307
LOG=N
Review URL: https://codereview.chromium.org/298723014
http://code.google.com/p/v8/source/detail?r=21467
Added:
/branches/bleeding_edge/test/mjsunit/regress/regress-3307.js
Modified:
/branches/bleeding_edge/src/hydrogen-instructions.h
=======================================
--- /dev/null
+++ /branches/bleeding_edge/test/mjsunit/regress/regress-3307.js Fri May 23
14:02:08 2014 UTC
@@ -0,0 +1,24 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function p(x) {
+ this.x = x;
+}
+
+function f() {
+ var a = new p(1), b = new p(2);
+ for (var i = 0; i < 1; i++) {
+ a.x += b.x;
+ }
+ return a.x;
+}
+
+new p(0.1); // make 'x' mutable box double field in p.
+
+assertEquals(3, f());
+assertEquals(3, f());
+%OptimizeFunctionOnNextCall(f);
+assertEquals(3, f());
=======================================
--- /branches/bleeding_edge/src/hydrogen-instructions.h Thu May 22 08:37:50
2014 UTC
+++ /branches/bleeding_edge/src/hydrogen-instructions.h Fri May 23 14:02:08
2014 UTC
@@ -714,6 +714,7 @@
if (r.IsTagged()) {
HType t = type();
if (t.IsSmi()) return Representation::Smi();
+ // TODO(mstarzinger): This is not correct for mutable HeapNumbers.
if (t.IsHeapNumber()) return Representation::Double();
if (t.IsHeapObject()) return r;
return Representation::None();
@@ -5503,6 +5504,10 @@
return Representation::Integer32();
}
}
+ // TODO(mstarzinger): Workaround until we track mutable HeapNumber types.
+ virtual Representation KnownOptimalRepresentation() V8_OVERRIDE {
+ return representation();
+ }
virtual Handle<Map> GetMonomorphicJSObjectMap() {
return known_initial_map_;
--
--
v8-dev mailing list
[email protected]
http://groups.google.com/group/v8-dev
---
You received this message because you are subscribed to the Google Groups "v8-dev" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
For more options, visit https://groups.google.com/d/optout.
