[turbofan] Try to insert soft deopt for JSStoreDataPropertyInLiteral

... at graph building time already, just like we do for other property
accesses.

Bug: v8:7790
Change-Id: I7ffc8ee4fb1df91fc59271edd7b70c14f531330a
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1762018
Reviewed-by: Maya Lekova <mslekova@chromium.org>
Commit-Queue: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#63278}
This commit is contained in:
Georg Neis 2019-08-20 13:12:55 +02:00 committed by Commit Bot
parent 05d83a0e73
commit 69d0eade54
2 changed files with 15 additions and 3 deletions

View File

@ -1475,9 +1475,20 @@ void BytecodeGraphBuilder::VisitStaDataPropertyInLiteral() {
int flags = bytecode_iterator().GetFlagOperand(2);
VectorSlotPair feedback =
CreateVectorSlotPair(bytecode_iterator().GetIndexOperand(3));
const Operator* op = javascript()->StoreDataPropertyInLiteral(feedback);
Node* node = NewNode(op, object, name, value, jsgraph()->Constant(flags));
JSTypeHintLowering::LoweringResult lowering =
TryBuildSimplifiedStoreKeyed(op, object, name, value, feedback.slot());
if (lowering.IsExit()) return;
Node* node = nullptr;
if (lowering.IsSideEffectFree()) {
node = lowering.value();
} else {
DCHECK(!lowering.Changed());
node = NewNode(op, object, name, value, jsgraph()->Constant(flags));
}
environment()->RecordAfterState(node, Environment::kAttachFrameState);
}

View File

@ -529,7 +529,8 @@ JSTypeHintLowering::ReduceStoreKeyedOperation(const Operator* op, Node* obj,
Node* effect, Node* control,
FeedbackSlot slot) const {
DCHECK(op->opcode() == IrOpcode::kJSStoreProperty ||
op->opcode() == IrOpcode::kJSStoreInArrayLiteral);
op->opcode() == IrOpcode::kJSStoreInArrayLiteral ||
op->opcode() == IrOpcode::kJSStoreDataPropertyInLiteral);
if (Node* node = TryBuildSoftDeopt(
slot, effect, control,
DeoptimizeReason::kInsufficientTypeFeedbackForGenericKeyedAccess)) {