AuroraMiddleware/v8
1
0
Fork 0
Code Issues 2 Pull Requests Releases Wiki Activity
e3242a4858
v8/test/mjsunit/regress/regress-crbug-631318-1.js

Ignoring revisions in .git-blame-ignore-revs. Click here to bypass and see the normal blame view.

20 lines
404 B
JavaScript
Raw Normal View History

[turbofan] Fix overly aggressive dead code elimination. When we eliminate nodes during truncation analysis that have no value uses, we must make sure that we do not eliminate speculative number operations that would have side effects depending on the inputs, i.e. for example a SpeculativeNumberMultiply(x,y) does ToNumber(x) and ToNumber(y) first, so if either x or y could throw an exception during ToNumber conversion, we must not eliminate the multiplication, even if it has no value uses (some later pass may kill the actual machine multiplication, but the checks on the inputs have to remain still). So we check whether both x and y are PlainPrimitive, i.e. neither Receiver nor Symbol, which could raise exceptions for ToNumber, and only in that case we propagate the "unusedness" of the node to its inputs. This also uncovered a bug with the type of Dead, which must be None, as this represents an impossible value, so we had to fix that too. Also the dead code removal will not work correctly for constants (i.e. pure nodes with no value inputs), as those might be cached and hence we might resurrect them for an unrelated node lowering during SimplifiedLowering and only later kill the actual node (replacing its uses with Dead), which would then also replace the new use with Dead. So that was fixed as well. This shouldn't change anything for the result, as unused constants automagically disappear from the graph later on anyways. R=yangguo@chromium.org BUG=chromium:631318 Review-Url: https://codereview.chromium.org/2182003002 Cr-Commit-Position: refs/heads/master@{#38038}
2016-07-26 07:07:32 +00:00
// Copyright 2016 the V8 project authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
// Flags: --allow-natives-syntax
[test] Add %PrepareForOptimization to even more tests With bytecode flushing and lazy feedback allocation, we need to call %PrepareForOptimization before we call %OptimizeFunctionOnNextCall, ideally after declaring the function. Bug: v8:8801, v8:8394, v8:9183 Change-Id: I3fb257282a30f6526a376a3afdedb44786320d34 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1648255 Commit-Queue: Mathias Bynens <mathias@chromium.org> Reviewed-by: Maya Lekova <mslekova@chromium.org> Reviewed-by: Mythri Alle <mythria@chromium.org> Cr-Commit-Position: refs/heads/master@{#62119}
2019-06-12 14:00:50 +00:00
function foo(x) {
return x < x;
}
[turbofan] Fix overly aggressive dead code elimination. When we eliminate nodes during truncation analysis that have no value uses, we must make sure that we do not eliminate speculative number operations that would have side effects depending on the inputs, i.e. for example a SpeculativeNumberMultiply(x,y) does ToNumber(x) and ToNumber(y) first, so if either x or y could throw an exception during ToNumber conversion, we must not eliminate the multiplication, even if it has no value uses (some later pass may kill the actual machine multiplication, but the checks on the inputs have to remain still). So we check whether both x and y are PlainPrimitive, i.e. neither Receiver nor Symbol, which could raise exceptions for ToNumber, and only in that case we propagate the "unusedness" of the node to its inputs. This also uncovered a bug with the type of Dead, which must be None, as this represents an impossible value, so we had to fix that too. Also the dead code removal will not work correctly for constants (i.e. pure nodes with no value inputs), as those might be cached and hence we might resurrect them for an unrelated node lowering during SimplifiedLowering and only later kill the actual node (replacing its uses with Dead), which would then also replace the new use with Dead. So that was fixed as well. This shouldn't change anything for the result, as unused constants automagically disappear from the graph later on anyways. R=yangguo@chromium.org BUG=chromium:631318 Review-Url: https://codereview.chromium.org/2182003002 Cr-Commit-Position: refs/heads/master@{#38038}
2016-07-26 07:07:32 +00:00
foo(1);
foo(2);
[test] Add %PrepareForOptimization to even more tests With bytecode flushing and lazy feedback allocation, we need to call %PrepareForOptimization before we call %OptimizeFunctionOnNextCall, ideally after declaring the function. Bug: v8:8801, v8:8394, v8:9183 Change-Id: I3fb257282a30f6526a376a3afdedb44786320d34 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1648255 Commit-Queue: Mathias Bynens <mathias@chromium.org> Reviewed-by: Maya Lekova <mslekova@chromium.org> Reviewed-by: Mythri Alle <mythria@chromium.org> Cr-Commit-Position: refs/heads/master@{#62119}
2019-06-12 14:00:50 +00:00
function bar(x) {
foo(x);
};
%PrepareFunctionForOptimization(bar);
[turbofan] Fix overly aggressive dead code elimination. When we eliminate nodes during truncation analysis that have no value uses, we must make sure that we do not eliminate speculative number operations that would have side effects depending on the inputs, i.e. for example a SpeculativeNumberMultiply(x,y) does ToNumber(x) and ToNumber(y) first, so if either x or y could throw an exception during ToNumber conversion, we must not eliminate the multiplication, even if it has no value uses (some later pass may kill the actual machine multiplication, but the checks on the inputs have to remain still). So we check whether both x and y are PlainPrimitive, i.e. neither Receiver nor Symbol, which could raise exceptions for ToNumber, and only in that case we propagate the "unusedness" of the node to its inputs. This also uncovered a bug with the type of Dead, which must be None, as this represents an impossible value, so we had to fix that too. Also the dead code removal will not work correctly for constants (i.e. pure nodes with no value inputs), as those might be cached and hence we might resurrect them for an unrelated node lowering during SimplifiedLowering and only later kill the actual node (replacing its uses with Dead), which would then also replace the new use with Dead. So that was fixed as well. This shouldn't change anything for the result, as unused constants automagically disappear from the graph later on anyways. R=yangguo@chromium.org BUG=chromium:631318 Review-Url: https://codereview.chromium.org/2182003002 Cr-Commit-Position: refs/heads/master@{#38038}
2016-07-26 07:07:32 +00:00
%OptimizeFunctionOnNextCall(bar);
assertThrows(() => bar(Symbol.toPrimitive));
Reference in New Issue Copy Permalink