AuroraMiddleware/v8
1
0
Fork 0
Code Issues 2 Pull Requests Releases Wiki Activity

Make it possible to hoist the neutering check for TA property accesses

Browse Source 
Also correctly set up the dependency between propoerty and elements
accesses and the checks

BUG=v8:3996
R=hpayer@chromium.org
LOG=n

Review URL: https://codereview.chromium.org/1107993002

Cr-Commit-Position: refs/heads/master@{#28087}
This commit is contained in:
jochen 2015-04-27 09:18:16 -07:00 committed by Commit bot
parent 919c54910f
commit 6a62e32138
1 changed files with 16 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

22
src/hydrogen.cc
View File

@ -2465,19 +2465,21 @@ HInstruction* HGraphBuilder::BuildUncheckedMonomorphicElementAccess(
length_checker.End();
return result;
} else {
HValue* neuter_checked_object = checked_object;
if (IsExternalArrayElementsKind(elements_kind)) {
HInstruction* buffer =
Add<HLoadNamedField>(checked_object, nullptr,
HObjectAccess::ForJSArrayBufferViewBuffer());
HInstruction* buffer_length = Add<HLoadNamedField>(
buffer, nullptr, HObjectAccess::ForJSArrayBufferByteLength());
Add<HBoundsCheck>(graph()->GetConstant0(), buffer_length);
neuter_checked_object =
Add<HBoundsCheck>(graph()->GetConstant0(), buffer_length);
}
DCHECK(store_mode == STANDARD_STORE);
checked_key = Add<HBoundsCheck>(key, length);
return AddElementAccess(
backing_store, checked_key, val,
checked_object, elements_kind, access_type);
return AddElementAccess(backing_store, checked_key, val,
neuter_checked_object, elements_kind,
access_type);
}
}
DCHECK(fast_smi_only_elements ||
@ -6340,8 +6342,16 @@ HValue* HOptimizedGraphBuilder::BuildMonomorphicAccess(
if (info->GetJSArrayBufferViewFieldAccess(&access)) {
DCHECK(info->IsLoad());
return BuildArrayBufferViewFieldAccessor(
object, checked_object, FieldIndex::ForInObjectOffset(access.offset()));
HValue* neuter_checked_object = checked_object;
if (IsExternalArrayElementsKind(info->map()->elements_kind())) {
HInstruction* buffer = Add<HLoadNamedField>(
checked_object, nullptr, HObjectAccess::ForJSArrayBufferViewBuffer());
HInstruction* buffer_length = Add<HLoadNamedField>(
buffer, nullptr, HObjectAccess::ForJSArrayBufferByteLength());
neuter_checked_object =
Add<HBoundsCheck>(graph()->GetConstant0(), buffer_length);
}
return New<HLoadNamedField>(object, neuter_checked_object, access);
}
if (info->name().is_identical_to(isolate()->factory()->prototype_string()) &&