AuroraMiddleware/v8
1
0
Fork 0
Code Issues 2 Pull Requests Releases Wiki Activity

[rab/gsab|turbofan] Fix JSCallReducer::ReduceDataViewAccess for RAB/GSAB

Browse Source 
Bug: v8:11111,chromium:1412001
Change-Id: Iff5e6efbb82060a62ed55ba84809b6469da872f9
Fixed: chromium:1412001
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4208945
Commit-Queue: Marja Hölttä <marja@chromium.org>
Reviewed-by: Nico Hartmann <nicohartmann@chromium.org>
Cr-Commit-Position: refs/heads/main@{#85582}
This commit is contained in:
Marja Hölttä 2023-02-01 09:47:36 +01:00 committed by V8 LUCI CQ
parent 3ed225c851
commit 6c84aa8e39
3 changed files with 13 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
src/compiler/heap-refs.cc
View File

@ -1470,6 +1470,10 @@ FixedArrayRef JSBoundFunctionRef::bound_arguments() const {
// Immutable after initialization.
HEAP_ACCESSOR_C(JSDataView, size_t, byte_length)
HEAP_ACCESSOR_B(JSDataView, bit_field, is_backed_by_rab,
JSDataView::IsBackedByRabBit)
HEAP_ACCESSOR_B(JSDataView, bit_field, is_length_tracking,
JSDataView::IsLengthTrackingBit)
HEAP_ACCESSOR_B(Map, bit_field2, elements_kind, Map::Bits2::ElementsKindBits)
HEAP_ACCESSOR_B(Map, bit_field3, is_dictionary_map,

2
src/compiler/heap-refs.h
View File

@ -432,6 +432,8 @@ class JSDataViewRef : public JSObjectRef {
Handle<JSDataView> object() const;
size_t byte_length() const;
bool is_backed_by_rab() const;
bool is_length_tracking() const;
};
class JSBoundFunctionRef : public JSObjectRef {

7
src/compiler/js-call-reducer.cc
View File

@ -7969,6 +7969,13 @@ Reduction JSCallReducer::ReduceDataViewAccess(Node* node, DataViewAccess access,
// We only deal with DataViews here whose [[ByteLength]] is at least
// {element_size}, as for all other DataViews it'll be out-of-bounds.
JSDataViewRef dataview = m.Ref(broker()).AsJSDataView();
if (dataview.is_backed_by_rab() || dataview.is_length_tracking()) {
// Disable this optimization for RAB/GSAB. TODO(v8:11111): Don't bail out,
// instead generate code for reading the current length.
return NoChange();
}
size_t length = dataview.byte_length();
if (length < element_size) return NoChange();