AuroraMiddleware/v8
1
0
Fork 0
Code Issues 2 Pull Requests Releases Wiki Activity

[turboprop] Handle MinimorphicPropertyAccess in ShouldUseMegamorphic

Browse Source 
It is possible that we fallback to GenericLowering for minimorphic
property accesses. So handle MinimorphicPropertyAccess in
ShouldUseMegamorphicLoadBuiltin.

Bug: chromium:1223733
Change-Id: Ia1ba8c8786be91dda841d4138cffe81185c066b0
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2997104
Commit-Queue: Mythri Alle <mythria@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#75505}
This commit is contained in:
Mythri A 2021-07-01 13:05:17 +01:00 committed by V8 LUCI CQ
parent d3cacbbbd5
commit 137d83b9b6
2 changed files with 21 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
src/compiler/js-generic-lowering.cc
View File

@ -255,6 +255,11 @@ bool ShouldUseMegamorphicLoadBuiltin(FeedbackSource const& source,
return feedback.AsNamedAccess().maps().empty();
} else if (feedback.kind() == ProcessedFeedback::kInsufficient) {
return false;
} else if (feedback.kind() == ProcessedFeedback::kMinimorphicPropertyAccess) {
// MinimorphicPropertyAccess is used for dynamic map checks and the IC state
// is either monomorphic or polymorphic. So it will still benefit from
// collecting feedback, so don't use megamorphic builtin.
return false;
}
UNREACHABLE();
}

16
test/mjsunit/regress/regress-1223733.js Normal file
View File

@ -0,0 +1,16 @@
// Copyright 2021 the V8 project authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
// Flags: --allow-natives-syntax --turboprop --turbo-dynamic-map-checks
function main() {
// Store something onto a function prototype so we will bailout of the
// function.prototype load optimization in NativeContextSpecialization.
isNaN.prototype = 14;
const v14 = isNaN.prototype;
}
%PrepareFunctionForOptimization(main);
main();
%OptimizeFunctionOnNextCall(main);
main();