AuroraMiddleware/v8
1
0
Fork 0
Code Issues 2 Pull Requests Releases Wiki Activity

[turbofan] Only consider inhabited types for constant folding in typed lowering.

Browse Source 
BUG=chromium:621423

Review-Url: https://codereview.chromium.org/2084483002
Cr-Commit-Position: refs/heads/master@{#37092}
This commit is contained in:
jarin 2016-06-20 00:55:34 -07:00 committed by Commit bot
parent 093df3fafc
commit 50d6837ada
2 changed files with 48 additions and 24 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
src/compiler/js-typed-lowering.cc
View File

@ -1849,6 +1849,7 @@ Reduction JSTypedLowering::Reduce(Node* node) {
if (!NodeProperties::IsConstant(node) && NodeProperties::IsTyped(node) && if (!NodeProperties::IsConstant(node) && NodeProperties::IsTyped(node) &&
node->op()->HasProperty(Operator::kEliminatable)) { node->op()->HasProperty(Operator::kEliminatable)) {
Type* upper = NodeProperties::GetType(node); Type* upper = NodeProperties::GetType(node);
if (upper->IsInhabited()) {
if (upper->IsConstant()) { if (upper->IsConstant()) {
Node* replacement = jsgraph()->Constant(upper->AsConstant()->Value()); Node* replacement = jsgraph()->Constant(upper->AsConstant()->Value());
ReplaceWithValue(node, replacement); ReplaceWithValue(node, replacement);
@ -1865,7 +1866,8 @@ Reduction JSTypedLowering::Reduce(Node* node) {
Node* replacement = jsgraph()->NullConstant(); Node* replacement = jsgraph()->NullConstant();
ReplaceWithValue(node, replacement); ReplaceWithValue(node, replacement);
return Changed(replacement); return Changed(replacement);
} else if (upper->Is(Type::PlainNumber()) && upper->Min() == upper->Max()) { } else if (upper->Is(Type::PlainNumber()) &&
upper->Min() == upper->Max()) {
Node* replacement = jsgraph()->Constant(upper->Min()); Node* replacement = jsgraph()->Constant(upper->Min());
ReplaceWithValue(node, replacement); ReplaceWithValue(node, replacement);
return Changed(replacement); return Changed(replacement);
@ -1875,6 +1877,7 @@ Reduction JSTypedLowering::Reduce(Node* node) {
return Changed(replacement); return Changed(replacement);
} }
} }
}
switch (node->opcode()) { switch (node->opcode()) {
case IrOpcode::kJSEqual: case IrOpcode::kJSEqual:
return ReduceJSEqual(node, false); return ReduceJSEqual(node, false);

21
test/mjsunit/compiler/regress-621423.js Normal file
View File

@ -0,0 +1,21 @@
// Copyright 2016 the V8 project authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
// Flags: --allow-natives-syntax
var a = [0, ""];
a[0] = 0;
function g(array) {
array[1] = undefined;
}
function f() {
g(function() {});
g(a);
}
f();
%OptimizeFunctionOnNextCall(f);
f();