AuroraMiddleware/v8
1
0
Fork 0
Code Issues 2 Pull Requests Releases Wiki Activity

Fix HIsSmiAndBranch::KnownSuccessorBlock() by deleting it

Browse Source 
Constants can still change their representation, so we cannot determine reachability of blocks based on their Smi-ness

BUG=chromium:351320
LOG=y
R=yangguo@chromium.org

Review URL: https://codereview.chromium.org/196943002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@19836 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
This commit is contained in:
jkummerow@chromium.org 2014-03-12 10:14:29 +00:00
parent ae1669b501
commit 105c1e08b7
3 changed files with 21 additions and 13 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

11
src/hydrogen-instructions.cc
View File

@ -3112,17 +3112,6 @@ bool HIsStringAndBranch::KnownSuccessorBlock(HBasicBlock** block) {
}
bool HIsSmiAndBranch::KnownSuccessorBlock(HBasicBlock** block) {
if (FLAG_fold_constants && value()->IsConstant()) {
*block = HConstant::cast(value())->HasSmiValue()
? FirstSuccessor() : SecondSuccessor();
return true;
}
*block = NULL;
return false;
}
bool HIsUndetectableAndBranch::KnownSuccessorBlock(HBasicBlock** block) {
if (FLAG_fold_constants && value()->IsConstant()) {
*block = HConstant::cast(value())->IsUndetectable()

2
src/hydrogen-instructions.h
View File

@ -4384,8 +4384,6 @@ class HIsSmiAndBranch V8_FINAL : public HUnaryControlInstruction {
return Representation::Tagged();
}
virtual bool KnownSuccessorBlock(HBasicBlock** block) V8_OVERRIDE;
protected:
virtual bool DataEquals(HValue* other) V8_OVERRIDE { return true; }
virtual int RedefinedOperandIndex() { return 0; }

21
test/mjsunit/regress/regress-crbug-351320.js Normal file
View File

@ -0,0 +1,21 @@
// Copyright 2014 the V8 project authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
// Flags: --allow-natives-syntax --fold-constants
var result = 0;
var o1 = {};
o2 = {y:1.5};
o2.y = 0;
o3 = o2.y;
function crash() {
for (var i = 0; i < 10; i++) {
result += o1.x + o3.foo;
}
}
crash();
%OptimizeFunctionOnNextCall(crash);
crash();