Revision: 21830
Author: [email protected]
Date: Fri Jun 13 07:51:45 2014 UTC
Log: GVN fix, preventing loads hoisting above stores to the same field
when HObjectAccess's representation is not the same.
[email protected]
Review URL: https://codereview.chromium.org/331493006
http://code.google.com/p/v8/source/detail?r=21830
Added:
/branches/bleeding_edge/test/mjsunit/regress/regress-gvn-ftt.js
Modified:
/branches/bleeding_edge/src/hydrogen-gvn.cc
/branches/bleeding_edge/src/hydrogen-instructions.h
=======================================
--- /dev/null
+++ /branches/bleeding_edge/test/mjsunit/regress/regress-gvn-ftt.js Fri Jun
13 07:51:45 2014 UTC
@@ -0,0 +1,27 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --track-field-types --use-gvn
+
+function A(id) {
+ this.id = id;
+}
+
+var a1 = new A(1);
+var a2 = new A(2);
+
+
+var g;
+function f(o, value) {
+ g = o.o;
+ o.o = value;
+ return o.o;
+}
+
+var obj = {o: a1};
+
+f(obj, a1);
+f(obj, a1);
+%OptimizeFunctionOnNextCall(f);
+assertEquals(a2.id, f(obj, a2).id);
=======================================
--- /branches/bleeding_edge/src/hydrogen-gvn.cc Tue Jun 3 08:12:43 2014 UTC
+++ /branches/bleeding_edge/src/hydrogen-gvn.cc Fri Jun 13 07:51:45 2014 UTC
@@ -466,7 +466,7 @@
bool SideEffectsTracker::ComputeInobjectField(HObjectAccess access,
int* index) {
for (int i = 0; i < num_inobject_fields_; ++i) {
- if (access.Equals(inobject_fields_[i])) {
+ if (access.SameField(inobject_fields_[i])) {
*index = i;
return true;
}
=======================================
--- /branches/bleeding_edge/src/hydrogen-instructions.h Thu Jun 12 09:58:10
2014 UTC
+++ /branches/bleeding_edge/src/hydrogen-instructions.h Fri Jun 13 07:51:45
2014 UTC
@@ -6202,7 +6202,14 @@
void PrintTo(StringStream* stream) const;
inline bool Equals(HObjectAccess that) const {
- return value_ == that.value_; // portion and offset must match
+ return value_ == that.value_;
+ }
+
+ // Returns true if |this| access refers to the same field as |that|,
which
+ // means that both have same |offset| and |portion| values.
+ inline bool SameField(HObjectAccess that) const {
+ uint32_t mask = PortionField::kMask | OffsetField::kMask;
+ return (value_ & mask) == (that.value_ & mask);
}
protected:
--
--
v8-dev mailing list
[email protected]
http://groups.google.com/group/v8-dev
---
You received this message because you are subscribed to the Google Groups "v8-dev" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
For more options, visit https://groups.google.com/d/optout.
