AuroraMiddleware/v8
1
0
Fork 0
Code Issues 2 Pull Requests Releases Wiki Activity

Do not inline array push for arrays with dictionary mode elements.

Browse Source 
BUG=chromium:452878
LOG=n

Review URL: https://codereview.chromium.org/880233002

Cr-Commit-Position: refs/heads/master@{#26357}
This commit is contained in:
jarin 2015-01-30 05:51:32 -08:00 committed by Commit bot
parent 5d12b2855d
commit 0cd991ebc0
3 changed files with 39 additions and 18 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

33
src/hydrogen.cc
View File

@ -8222,6 +8222,18 @@ bool HOptimizedGraphBuilder::TryInlineBuiltinFunctionCall(Call* expr) {
}
// static
bool HOptimizedGraphBuilder::CanInlineArrayResizeOperation(
Handle<Map> receiver_map) {
return !receiver_map.is_null() &&
receiver_map->instance_type() == JS_ARRAY_TYPE &&
IsFastElementsKind(receiver_map->elements_kind()) &&
!receiver_map->is_dictionary_map() &&
!JSArray::IsReadOnlyLengthDescriptor(receiver_map) &&
!receiver_map->is_observed() && receiver_map->is_extensible();
}
bool HOptimizedGraphBuilder::TryInlineBuiltinMethodCall(
Call* expr, Handle<JSFunction> function, Handle<Map> receiver_map,
int args_count_no_receiver) {
@ -8341,13 +8353,8 @@ bool HOptimizedGraphBuilder::TryInlineBuiltinMethodCall(
}
break;
case kArrayPop: {
if (receiver_map.is_null()) return false;
if (receiver_map->instance_type() != JS_ARRAY_TYPE) return false;
if (!CanInlineArrayResizeOperation(receiver_map)) return false;
ElementsKind elements_kind = receiver_map->elements_kind();
if (JSArray::IsReadOnlyLengthDescriptor(receiver_map)) return false;
if (!IsFastElementsKind(elements_kind)) return false;
if (receiver_map->is_observed()) return false;
if (!receiver_map->is_extensible()) return false;
Drop(args_count_no_receiver);
HValue* result;
@ -8404,13 +8411,8 @@ bool HOptimizedGraphBuilder::TryInlineBuiltinMethodCall(
return true;
}
case kArrayPush: {
if (receiver_map.is_null()) return false;
if (receiver_map->instance_type() != JS_ARRAY_TYPE) return false;
if (!CanInlineArrayResizeOperation(receiver_map)) return false;
ElementsKind elements_kind = receiver_map->elements_kind();
if (!IsFastElementsKind(elements_kind)) return false;
if (receiver_map->is_observed()) return false;
if (JSArray::IsReadOnlyLengthDescriptor(receiver_map)) return false;
if (!receiver_map->is_extensible()) return false;
// If there may be elements accessors in the prototype chain, the fast
// inlined version can't be used.
@ -8457,13 +8459,8 @@ bool HOptimizedGraphBuilder::TryInlineBuiltinMethodCall(
return true;
}
case kArrayShift: {
if (receiver_map.is_null()) return false;
if (receiver_map->instance_type() != JS_ARRAY_TYPE) return false;
if (!CanInlineArrayResizeOperation(receiver_map)) return false;
ElementsKind kind = receiver_map->elements_kind();
if (JSArray::IsReadOnlyLengthDescriptor(receiver_map)) return false;
if (!IsFastElementsKind(kind)) return false;
if (receiver_map->is_observed()) return false;
if (!receiver_map->is_extensible()) return false;
// If there may be elements accessors in the prototype chain, the fast
// inlined version can't be used.

1
src/hydrogen.h
View File

@ -2391,6 +2391,7 @@ class HOptimizedGraphBuilder : public HGraphBuilder, public AstVisitor {
int argc,
BailoutId ast_id,
ApiCallType call_type);
static bool CanInlineArrayResizeOperation(Handle<Map> receiver_map);
// If --trace-inlining, print a line of the inlining trace. Inlining
// succeeded if the reason string is NULL and failed if there is a

23
test/mjsunit/array-push12.js Normal file
View File

@ -0,0 +1,23 @@
// Copyright 2015 the V8 project authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
// Flags: --allow-natives-syntax
var a = [];
for (var i = -20; i < 0; ++i) {
a[i] = 0;
}
function g() {
[].push.apply(a, arguments);
}
function f() {
g();
}
g();
g();
%OptimizeFunctionOnNextCall(f);
f();