GVN fix, preventing loads hoisting above stores to the same field when HObjectAccess's representation is not the same.
R=bmeurer@chromium.org Review URL: https://codereview.chromium.org/331493006 git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@21830 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
This commit is contained in:
parent
fd1ace4d94
commit
41e9d916c4
@ -466,7 +466,7 @@ bool SideEffectsTracker::ComputeGlobalVar(Unique<Cell> cell, int* index) {
|
|||||||
bool SideEffectsTracker::ComputeInobjectField(HObjectAccess access,
|
bool SideEffectsTracker::ComputeInobjectField(HObjectAccess access,
|
||||||
int* index) {
|
int* index) {
|
||||||
for (int i = 0; i < num_inobject_fields_; ++i) {
|
for (int i = 0; i < num_inobject_fields_; ++i) {
|
||||||
if (access.Equals(inobject_fields_[i])) {
|
if (access.SameField(inobject_fields_[i])) {
|
||||||
*index = i;
|
*index = i;
|
||||||
return true;
|
return true;
|
||||||
}
|
}
|
||||||
|
@ -6202,7 +6202,14 @@ class HObjectAccess V8_FINAL {
|
|||||||
void PrintTo(StringStream* stream) const;
|
void PrintTo(StringStream* stream) const;
|
||||||
|
|
||||||
inline bool Equals(HObjectAccess that) const {
|
inline bool Equals(HObjectAccess that) const {
|
||||||
return value_ == that.value_; // portion and offset must match
|
return value_ == that.value_;
|
||||||
|
}
|
||||||
|
|
||||||
|
// Returns true if |this| access refers to the same field as |that|, which
|
||||||
|
// means that both have same |offset| and |portion| values.
|
||||||
|
inline bool SameField(HObjectAccess that) const {
|
||||||
|
uint32_t mask = PortionField::kMask | OffsetField::kMask;
|
||||||
|
return (value_ & mask) == (that.value_ & mask);
|
||||||
}
|
}
|
||||||
|
|
||||||
protected:
|
protected:
|
||||||
|
27
test/mjsunit/regress/regress-gvn-ftt.js
Normal file
27
test/mjsunit/regress/regress-gvn-ftt.js
Normal file
@ -0,0 +1,27 @@
|
|||||||
|
// Copyright 2014 the V8 project authors. All rights reserved.
|
||||||
|
// Use of this source code is governed by a BSD-style license that can be
|
||||||
|
// found in the LICENSE file.
|
||||||
|
|
||||||
|
// Flags: --allow-natives-syntax --track-field-types --use-gvn
|
||||||
|
|
||||||
|
function A(id) {
|
||||||
|
this.id = id;
|
||||||
|
}
|
||||||
|
|
||||||
|
var a1 = new A(1);
|
||||||
|
var a2 = new A(2);
|
||||||
|
|
||||||
|
|
||||||
|
var g;
|
||||||
|
function f(o, value) {
|
||||||
|
g = o.o;
|
||||||
|
o.o = value;
|
||||||
|
return o.o;
|
||||||
|
}
|
||||||
|
|
||||||
|
var obj = {o: a1};
|
||||||
|
|
||||||
|
f(obj, a1);
|
||||||
|
f(obj, a1);
|
||||||
|
%OptimizeFunctionOnNextCall(f);
|
||||||
|
assertEquals(a2.id, f(obj, a2).id);
|
Loading…
Reference in New Issue
Block a user