AuroraMiddleware/v8
1
0
Fork 0
Code Issues 2 Pull Requests Releases Wiki Activity

[TurboFan] Ensure typer knows all inputs to StringConcat are Strings.

Browse Source 
Adds a CheckString to all operand inputs of JSStringConcat. The operands are
already known to be strings, so this will get eliminated in almost all cases,
however, if there is a yield within the concatenation then we lose the
knowledge that the previous operands are strings since the values are loaded
from the generator object. Adds a test for this case.

BUG=v8:6243

Change-Id: I1601a316e6efbed1c53486f1027cb0ea023ff030
Reviewed-on: https://chromium-review.googlesource.com/549301
Commit-Queue: Ross McIlroy <rmcilroy@chromium.org>
Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46243}
This commit is contained in:
Ross McIlroy 2017-06-27 11:40:36 +01:00 committed by Commit Bot
parent 5f4a0d699d
commit 6321916c46
2 changed files with 20 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
src/compiler/bytecode-graph-builder.cc
View File

@ -2178,8 +2178,12 @@ void BytecodeGraphBuilder::VisitStringConcat() {
local_zone()->NewArray<Node*>(static_cast<size_t>(operand_count));
int operand_base = first_reg.index();
for (int i = 0; i < operand_count; ++i) {
operands[i] =
Node* reg =
environment()->LookupRegister(interpreter::Register(operand_base + i));
// Explicitly insert a string check here. All operands are already strings,
// however in the case of generator yields in the middle of string
// concatenations we might lose the knowledge that the operand is a string.
operands[i] = NewNode(simplified()->CheckString(), reg);
}
Node* node = MakeNode(javascript()->StringConcat(operand_count),

15
test/mjsunit/compiler/string-concat-yield.js Normal file
View File

@ -0,0 +1,15 @@
// Copyright 2016 the V8 project authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
// Flags: --allow-natives-syntax
function* foo() {
var f = `foo${ yield 'yielded' }bar`;
return f;
}
%OptimizeFunctionOnNextCall(foo);
var gen = foo();
assertEquals('yielded', gen.next('unused').value);
assertEquals('foobazbar', gen.next('baz').value);