AuroraMiddleware/v8
1
0
Fork 0
Code Issues 2 Pull Requests Releases Wiki Activity

[turbofan] Remove over-restrictive DCHECKs.

Browse Source 
The KeyedStoreMode that we get out of the FeedbackNexus doesn't
necessarily need to apply when we have "static knowledge" about
the receiver, i.e. when the receiver is a known JSTypedArray, but
the KEYED_STORE_IC has seen only JSArray instances so far. The
DCHECK was too restrictive in this case, since we can just ignore
the KEYED_STORE_IC mode (like we ignore the maps).

BUG=chromium:685050
R=ishell@chromium.org

Review-Url: https://codereview.chromium.org/2668643002
Cr-Commit-Position: refs/heads/master@{#42810}
This commit is contained in:
bmeurer 2017-01-31 01:00:55 -08:00 committed by Commit bot
parent 68ae57ce1e
commit 64eae6eff2
2 changed files with 19 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
src/compiler/js-native-context-specialization.cc
View File

@ -1767,7 +1767,6 @@ JSNativeContextSpecialization::BuildElementAccess(
effect, control);
} else {
// Check that the {index} is in the valid range for the {receiver}.
DCHECK_EQ(STANDARD_STORE, store_mode);
index = effect = graph()->NewNode(simplified()->CheckBounds(), index,
length, effect, control);
}
@ -1825,7 +1824,6 @@ JSNativeContextSpecialization::BuildElementAccess(
graph()->NewNode(common()->EffectPhi(2), etrue, efalse, control);
} else {
// Perform the actual store
DCHECK_EQ(STANDARD_STORE, store_mode);
effect = graph()->NewNode(
simplified()->StoreTypedElement(external_array_type), buffer,
base_pointer, external_pointer, index, value, effect, control);

19
test/mjsunit/regress/regress-crbug-685050.js Normal file
View File

@ -0,0 +1,19 @@
// Copyright 2017 the V8 project authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
// Flags: --allow-natives-syntax
function bar(a) {
a[0] = 0;
a[1] = 0;
}
var a = new Int32Array(2);
bar([1, 2, 3]);
function foo() {
bar([1, 2, 3]);
bar(a);
}
%OptimizeFunctionOnNextCall(foo);
foo();