AuroraMiddleware/v8
1
0
Fork 0
Code Issues 2 Pull Requests Releases Wiki Activity

[turbofan] Fix logic error in ReduceJSConstruct.

Browse Source 
Don't return NoChange when the new_target input to a JSConstruct node is
already a HeapConstant, but rather use that constant in the interesting
lowering below. This was introduced accidentally by 

  https://chromium-review.googlesource.com/604790

earlier. Also don't use ShouldUseCallICFeedback predicate here, as that
doesn't really make sense for JSConstruct, but is mostly interesting for
JSCall (hence the name).

Bug: v8:5517, v8:6399, v8:6679
Change-Id: I96201281cf1a10f2bfd2dc3859455161eb310ccf
Reviewed-on: https://chromium-review.googlesource.com/607887
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Commit-Queue: Benedikt Meurer <bmeurer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#47237}
This commit is contained in:
Benedikt Meurer 2017-08-09 09:51:41 +02:00 committed by Commit Bot
parent 703b5ff960
commit 083ac1797f
1 changed files with 2 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
src/compiler/js-call-reducer.cc
View File

@ -1411,10 +1411,8 @@ Reduction JSCallReducer::ReduceJSConstruct(Node* node) {
NodeProperties::ReplaceValueInput(node, array_function, 1);
NodeProperties::ChangeOp(node, javascript()->CreateArray(arity, site));
return Changed(node);
} else if (feedback->IsWeakCell()) {
// Check if we want to use CallIC feedback here.
if (!ShouldUseCallICFeedback(new_target)) return NoChange();
} else if (feedback->IsWeakCell() &&
!HeapObjectMatcher(new_target).HasValue()) {
Handle<WeakCell> cell = Handle<WeakCell>::cast(feedback);
if (cell->value()->IsConstructor()) {
Node* new_target_feedback =