Reviewers: Benedikt Meurer,
Message:
PTAL
Description:
GVN fix, preventing loads hoisting above stores to the same field when
HObjectAccess's representation is not the same.
Please review this at https://codereview.chromium.org/331493006/
SVN Base: https://v8.googlecode.com/svn/branches/bleeding_edge
Affected files (+36, -2 lines):
M src/hydrogen-gvn.cc
M src/hydrogen-instructions.h
A test/mjsunit/regress/regress-gvn-ftt.js
Index: src/hydrogen-gvn.cc
diff --git a/src/hydrogen-gvn.cc b/src/hydrogen-gvn.cc
index
e6f1ae90f39306f8214123adef1c8ff217b6d2f3..385947d754f2cd624a4a0c32579a9d4063845479
100644
--- a/src/hydrogen-gvn.cc
+++ b/src/hydrogen-gvn.cc
@@ -466,7 +466,7 @@ bool SideEffectsTracker::ComputeGlobalVar(Unique<Cell>
cell, int* index) {
bool SideEffectsTracker::ComputeInobjectField(HObjectAccess access,
int* index) {
for (int i = 0; i < num_inobject_fields_; ++i) {
- if (access.Equals(inobject_fields_[i])) {
+ if (access.SameField(inobject_fields_[i])) {
*index = i;
return true;
}
Index: src/hydrogen-instructions.h
diff --git a/src/hydrogen-instructions.h b/src/hydrogen-instructions.h
index
f1720f444247d83635c84d00a99cf2457ee0022e..fce5d681a95cc1afb133b91a4ae3b347ad66e9e2
100644
--- a/src/hydrogen-instructions.h
+++ b/src/hydrogen-instructions.h
@@ -6202,7 +6202,14 @@ class HObjectAccess V8_FINAL {
void PrintTo(StringStream* stream) const;
inline bool Equals(HObjectAccess that) const {
- return value_ == that.value_; // portion and offset must match
+ return value_ == that.value_;
+ }
+
+ // Returns true if |this| access refers to the same field as |that|,
which
+ // means that both have same |offset| and |portion| values.
+ inline bool SameField(HObjectAccess that) const {
+ uint32_t mask = PortionField::kMask | OffsetField::kMask;
+ return (value_ & mask) == (that.value_ & mask);
}
protected:
Index: test/mjsunit/regress/regress-gvn-ftt.js
diff --git a/test/mjsunit/regress/regress-gvn-ftt.js
b/test/mjsunit/regress/regress-gvn-ftt.js
new file mode 100644
index
0000000000000000000000000000000000000000..d2cb44381d5f63932b0c3a5e04a84355abf20f27
--- /dev/null
+++ b/test/mjsunit/regress/regress-gvn-ftt.js
@@ -0,0 +1,27 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --track-field-types --use-gvn
+
+function A(id) {
+ this.id = id;
+}
+
+var a1 = new A(1);
+var a2 = new A(2);
+
+
+var g;
+function f(o, value) {
+ g = o.o;
+ o.o = value;
+ return o.o;
+}
+
+var obj = {o: a1};
+
+f(obj, a1);
+f(obj, a1);
+%OptimizeFunctionOnNextCall(f);
+assertEquals(a2.id, f(obj, a2).id);
--
--
v8-dev mailing list
[email protected]
http://groups.google.com/group/v8-dev
---
You received this message because you are subscribed to the Google Groups "v8-dev" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
For more options, visit https://groups.google.com/d/optout.
