AuroraMiddleware/v8
1
0
Fork 0
Code Issues 2 Pull Requests Releases Wiki Activity

Revert of [turbofan] Set proper representation for initial arguments length. (patchset #1 id:1 of https://codereview.chromium.org/2810333004/ )

Browse Source 
Reason for revert:
Field representation is not preserved

Original issue's description:
> [turbofan] Set proper representation for initial arguments length.
>
> The JSArgumentsObject::length representation is initially Smi, so we can
> record that on the initial map and use it to optimize the accesses in
> TurboFan based on that. Similar for JSSloppyArgumentsObject::caller.
>
> BUG=v8:6262
> R=yangguo@chromium.org
>
> Review-Url: https://codereview.chromium.org/2810333004
> Cr-Commit-Position: refs/heads/master@{#44644}
> Committed: 5eec7df9b3

TBR=yangguo@chromium.org,bmeurer@chromium.org
# Not skipping CQ checks because original CL landed more than 1 days ago.
BUG=v8:6262

Review-Url: https://codereview.chromium.org/2825323002
Cr-Commit-Position: refs/heads/master@{#44893}
This commit is contained in:
cbruni 2017-04-26 07:53:21 -07:00 committed by Commit bot
parent 8952aef167
commit 6b4b062489
3 changed files with 19 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
src/bootstrapper.cc
View File

@ -3072,13 +3072,13 @@ void Genesis::InitializeGlobal(Handle<JSGlobalObject> global_object,
{ // length
Descriptor d = Descriptor::DataField(
factory->length_string(), JSSloppyArgumentsObject::kLengthIndex,
DONT_ENUM, Representation::Smi());
DONT_ENUM, Representation::Tagged());
map->AppendDescriptor(&d);
}
{ // callee
Descriptor d = Descriptor::DataField(
factory->callee_string(), JSSloppyArgumentsObject::kCalleeIndex,
DONT_ENUM, Representation::HeapObject());
DONT_ENUM, Representation::Tagged());
map->AppendDescriptor(&d);
}
// @@iterator method is added later.
@ -3129,7 +3129,7 @@ void Genesis::InitializeGlobal(Handle<JSGlobalObject> global_object,
{ // length
Descriptor d = Descriptor::DataField(
factory->length_string(), JSStrictArgumentsObject::kLengthIndex,
DONT_ENUM, Representation::Smi());
DONT_ENUM, Representation::Tagged());
map->AppendDescriptor(&d);
}
{ // callee

4
src/compiler/access-builder.cc
View File

@ -716,8 +716,8 @@ FieldAccess AccessBuilder::ForValue() {
FieldAccess AccessBuilder::ForArgumentsLength() {
FieldAccess access = {kTaggedBase, JSArgumentsObject::kLengthOffset,
Handle<Name>(), MaybeHandle<Map>(),
Type::SignedSmall(), MachineType::TaggedSigned(),
kNoWriteBarrier};
Type::NonInternal(), MachineType::AnyTagged(),
kFullWriteBarrier};
return access;
}

14
test/mjsunit/arguments.js
View File

@ -271,3 +271,17 @@ assertEquals(117, arg_set(0xFFFFFFFF));
assertEquals(undefined, args[key]);
assertEquals(2, args.length);
})();
(function testSloppyArgumentsLengthMapChange() {
function f(a) { return arguments };
let args1 = f(1);
let args2 = f(1,2);
assertTrue(%HaveSameMap(args1, args2));
// Changing the length type doesn't causes a map transition.
args2.length = 12;
assertTrue(%HaveSameMap(args1, args2));
args2.length = 12.0;
assertTrue(%HaveSameMap(args1, args2));
args2.length = "aa"
assertTrue(%HaveSameMap(args1, args2));
})();