AuroraMiddleware/v8
1
0
Fork 0
Code Issues 2 Pull Requests Releases Wiki Activity

[turbofan] Make GraphAssembler branching respect typing

Browse Source 
GraphAssembler creates Phi nodes and creates additional inputs to them
depending on how many jumps go there. If the typer decorator is active,
it will type the Phi node at creation time. GraphAssembler was not aware
of types (until recently it was not used while the graph is typed) and
did not update the Phi type with each new input. This CL fixes that.

Bug: chromium:1082704
Change-Id: Id94bcda752c7b3dc836eb2b6c6b55b1690185a09
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2202978
Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Reviewed-by: Nico Hartmann <nicohartmann@chromium.org>
Commit-Queue: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67823}
This commit is contained in:
Georg Neis 2020-05-15 11:42:39 +02:00 committed by Commit Bot
parent 6771d3e318
commit 349e4ee3fc
2 changed files with 24 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
src/compiler/graph-assembler.h
View File

@ -582,6 +582,7 @@ void GraphAssembler::MergeState(GraphAssemblerLabel<sizeof...(Vars)>* label,
label->effect_->ReplaceInput(1, effect());
for (size_t i = 0; i < kVarCount; i++) {
label->bindings_[i]->ReplaceInput(1, var_array[i]);
CHECK(!NodeProperties::IsTyped(var_array[i])); // Unsupported.
}
}
} else {
@ -625,6 +626,13 @@ void GraphAssembler::MergeState(GraphAssemblerLabel<sizeof...(Vars)>* label,
NodeProperties::ChangeOp(
label->bindings_[i],
common()->Phi(label->representations_[i], merged_count + 1));
if (NodeProperties::IsTyped(label->bindings_[i])) {
CHECK(NodeProperties::IsTyped(var_array[i]));
Type old_type = NodeProperties::GetType(label->bindings_[i]);
Type new_type = Type::Union(
old_type, NodeProperties::GetType(var_array[i]), graph()->zone());
NodeProperties::SetType(label->bindings_[i], new_type);
}
}
}
}

16
test/mjsunit/compiler/regress-1082704.js Normal file
View File

@ -0,0 +1,16 @@
// Copyright 2020 the V8 project authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
// Flags: --allow-natives-syntax
var array = [[]];
function foo() {
const x = array[0];
const y = [][0];
return x == y;
}
%PrepareFunctionForOptimization(foo);
assertFalse(foo());
%OptimizeFunctionOnNextCall(foo);
assertFalse(foo());