AuroraMiddleware/v8
1
0
Fork 0
Code Issues 2 Pull Requests Releases Wiki Activity

GVN fix, preventing loads hoisting above stores to the same field when HObjectAccess's representation is not the same.

Browse Source 
R=bmeurer@chromium.org

Review URL: https://codereview.chromium.org/331493006

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@21830 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
This commit is contained in:
ishell@chromium.org 2014-06-13 07:51:45 +00:00
parent fd1ace4d94
commit 41e9d916c4
3 changed files with 36 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
src/hydrogen-gvn.cc
View File

@ -466,7 +466,7 @@ bool SideEffectsTracker::ComputeGlobalVar(Unique<Cell> cell, int* index) {
bool SideEffectsTracker::ComputeInobjectField(HObjectAccess access,
int* index) {
for (int i = 0; i < num_inobject_fields_; ++i) {
if (access.Equals(inobject_fields_[i])) {
if (access.SameField(inobject_fields_[i])) {
*index = i;
return true;
}

9
src/hydrogen-instructions.h
View File

@ -6202,7 +6202,14 @@ class HObjectAccess V8_FINAL {
void PrintTo(StringStream* stream) const;
inline bool Equals(HObjectAccess that) const {
return value_ == that.value_; // portion and offset must match
return value_ == that.value_;
}
// Returns true if |this| access refers to the same field as |that|, which
// means that both have same |offset| and |portion| values.
inline bool SameField(HObjectAccess that) const {
uint32_t mask = PortionField::kMask | OffsetField::kMask;
return (value_ & mask) == (that.value_ & mask);
}
protected:

27
test/mjsunit/regress/regress-gvn-ftt.js Normal file
View File

@ -0,0 +1,27 @@
// Copyright 2014 the V8 project authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
// Flags: --allow-natives-syntax --track-field-types --use-gvn
function A(id) {
this.id = id;
}
var a1 = new A(1);
var a2 = new A(2);
var g;
function f(o, value) {
g = o.o;
o.o = value;
return o.o;
}
var obj = {o: a1};
f(obj, a1);
f(obj, a1);
%OptimizeFunctionOnNextCall(f);
assertEquals(a2.id, f(obj, a2).id);