AuroraMiddleware/v8
1
0
Fork 0
Code Issues 2 Pull Requests Releases Wiki Activity

[turbofan] Only consider inhabited types for constant folding in typed lowering.

Browse Source 
BUG=chromium:621423

Review-Url: https://codereview.chromium.org/2084483002
Cr-Commit-Position: refs/heads/master@{#37092}
This commit is contained in:
jarin 2016-06-20 00:55:34 -07:00 committed by Commit bot
parent 093df3fafc
commit 50d6837ada
2 changed files with 48 additions and 24 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

51
src/compiler/js-typed-lowering.cc
View File

@ -1849,30 +1849,33 @@ Reduction JSTypedLowering::Reduce(Node* node) {
if (!NodeProperties::IsConstant(node) && NodeProperties::IsTyped(node) && if (!NodeProperties::IsConstant(node) && NodeProperties::IsTyped(node) &&
node->op()->HasProperty(Operator::kEliminatable)) { node->op()->HasProperty(Operator::kEliminatable)) {
Type* upper = NodeProperties::GetType(node); Type* upper = NodeProperties::GetType(node);
if (upper->IsConstant()) { if (upper->IsInhabited()) {
Node* replacement = jsgraph()->Constant(upper->AsConstant()->Value()); if (upper->IsConstant()) {
ReplaceWithValue(node, replacement); Node* replacement = jsgraph()->Constant(upper->AsConstant()->Value());
return Changed(replacement); ReplaceWithValue(node, replacement);
} else if (upper->Is(Type::MinusZero())) { return Changed(replacement);
Node* replacement = jsgraph()->Constant(factory()->minus_zero_value()); } else if (upper->Is(Type::MinusZero())) {
ReplaceWithValue(node, replacement); Node* replacement = jsgraph()->Constant(factory()->minus_zero_value());
return Changed(replacement); ReplaceWithValue(node, replacement);
} else if (upper->Is(Type::NaN())) { return Changed(replacement);
Node* replacement = jsgraph()->NaNConstant(); } else if (upper->Is(Type::NaN())) {
ReplaceWithValue(node, replacement); Node* replacement = jsgraph()->NaNConstant();
return Changed(replacement); ReplaceWithValue(node, replacement);
} else if (upper->Is(Type::Null())) { return Changed(replacement);
Node* replacement = jsgraph()->NullConstant(); } else if (upper->Is(Type::Null())) {
ReplaceWithValue(node, replacement); Node* replacement = jsgraph()->NullConstant();
return Changed(replacement); ReplaceWithValue(node, replacement);
} else if (upper->Is(Type::PlainNumber()) && upper->Min() == upper->Max()) { return Changed(replacement);
Node* replacement = jsgraph()->Constant(upper->Min()); } else if (upper->Is(Type::PlainNumber()) &&
ReplaceWithValue(node, replacement); upper->Min() == upper->Max()) {
return Changed(replacement); Node* replacement = jsgraph()->Constant(upper->Min());
} else if (upper->Is(Type::Undefined())) { ReplaceWithValue(node, replacement);
Node* replacement = jsgraph()->UndefinedConstant(); return Changed(replacement);
ReplaceWithValue(node, replacement); } else if (upper->Is(Type::Undefined())) {
return Changed(replacement); Node* replacement = jsgraph()->UndefinedConstant();
ReplaceWithValue(node, replacement);
return Changed(replacement);
}
} }
} }
switch (node->opcode()) { switch (node->opcode()) {

21
test/mjsunit/compiler/regress-621423.js Normal file
View File

@ -0,0 +1,21 @@
// Copyright 2016 the V8 project authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
// Flags: --allow-natives-syntax
var a = [0, ""];
a[0] = 0;
function g(array) {
array[1] = undefined;
}
function f() {
g(function() {});
g(a);
}
f();
%OptimizeFunctionOnNextCall(f);
f();