Fix deopts caused by misplaced COW checks.

TEST=Performance of pixel-array-blur back to normal.

Review URL: http://codereview.chromium.org/7471034

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@8709 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
This commit is contained in:
jkummerow@chromium.org 2011-07-21 12:01:51 +00:00
parent 3ff882ff64
commit 622cf2e091
2 changed files with 12 additions and 6 deletions

View File

@ -1898,10 +1898,14 @@ class HLoadExternalArrayPointer: public HUnaryOperation {
};
class HCheckMap: public HUnaryOperation {
class HCheckMap: public HTemplateInstruction<2> {
public:
HCheckMap(HValue* value, Handle<Map> map)
: HUnaryOperation(value), map_(map) {
HCheckMap(HValue* value, Handle<Map> map, HValue* typecheck = NULL)
: map_(map) {
SetOperandAt(0, value);
// If callers don't depend on a typecheck, they can pass in NULL. In that
// case we use a copy of the |value| argument as a dummy value.
SetOperandAt(1, typecheck != NULL ? typecheck : value);
set_representation(Representation::Tagged());
SetFlag(kUseGVN);
SetFlag(kDependsOnMaps);
@ -1913,6 +1917,7 @@ class HCheckMap: public HUnaryOperation {
virtual void PrintDataTo(StringStream* stream);
virtual HType CalculateInferredType();
HValue* value() { return OperandAt(0); }
Handle<Map> map() const { return map_; }
DECLARE_CONCRETE_INSTRUCTION(CheckMap)

View File

@ -3911,7 +3911,7 @@ HInstruction* HGraphBuilder::BuildMonomorphicElementAccess(HValue* object,
HInstruction* mapcheck = AddInstruction(new(zone()) HCheckMap(object, map));
HInstruction* elements = AddInstruction(new(zone()) HLoadElements(object));
bool fast_double_elements = map->has_fast_double_elements();
if (is_store && !fast_double_elements) {
if (is_store && map->has_fast_elements()) {
AddInstruction(new(zone()) HCheckMap(
elements, isolate()->factory()->fixed_array_map()));
}
@ -4022,9 +4022,10 @@ HValue* HGraphBuilder::HandlePolymorphicElementAccess(HValue* object,
elements_kind == JSObject::FAST_DOUBLE_ELEMENTS) {
bool fast_double_elements =
elements_kind == JSObject::FAST_DOUBLE_ELEMENTS;
if (is_store && !fast_double_elements) {
if (is_store && elements_kind == JSObject::FAST_ELEMENTS) {
AddInstruction(new(zone()) HCheckMap(
elements, isolate()->factory()->fixed_array_map()));
elements, isolate()->factory()->fixed_array_map(),
elements_kind_branch));
}
HBasicBlock* if_jsarray = graph()->CreateBasicBlock();
HBasicBlock* if_fastobject = graph()->CreateBasicBlock();