AuroraMiddleware/v8
1
0
Fork 0
Code Issues 2 Pull Requests Releases Wiki Activity

Fix optimistic BCE to back off after deopt

Browse Source 
BUG=v8:3176
LOG=n
R=danno@chromium.org

Review URL: https://codereview.chromium.org/177523002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@19530 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
This commit is contained in:
jkummerow@chromium.org 2014-02-24 13:15:31 +00:00
parent 3ffc6b5d75
commit 37b6fd07c1
2 changed files with 30 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
src/hydrogen-bce.cc
View File

@ -375,7 +375,8 @@ BoundsCheckBbData* HBoundsCheckEliminationPhase::PreProcessBlock(
check->DeleteAndReplaceWith(check->ActualValue());
} else if (data->BasicBlock() == bb) {
data->CoverCheck(check, offset);
} else {
} else if (graph()->use_optimistic_licm() ||
bb->IsLoopSuccessorDominator()) {
int32_t new_lower_offset = offset < data->LowerOffset()
? offset
: data->LowerOffset();

28
test/mjsunit/regress/regress-3176.js Normal file
View File

@ -0,0 +1,28 @@
// Copyright 2014 the V8 project authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
// Flags: --allow-natives-syntax
function foo(a) {
var sum = 0;
for (var i = 0; i < 10; i++) {
sum += a[i];
if (i > 6) {
sum -= a[i - 4];
sum -= a[i - 5];
}
}
return sum;
}
var a = new Int32Array(10);
foo(a);
foo(a);
%OptimizeFunctionOnNextCall(foo);
foo(a);
%OptimizeFunctionOnNextCall(foo);
foo(a);
assertOptimized(foo);