AuroraMiddleware/v8
1
0
Fork 0
Code Issues 2 Pull Requests Releases Wiki Activity

[turbofan] Deoptimize on access to neutered typed arrays.

Browse Source 
We got the condition wrong and actually deoptimized when the typed array
was not neutered. This fixes the deopt loop in Math.random and actually
many programs that use typed arrays.

R=jarin@chromium.org

Review-Url: https://codereview.chromium.org/1970123002
Cr-Commit-Position: refs/heads/master@{#36194}
This commit is contained in:
bmeurer 2016-05-11 23:29:05 -07:00 committed by Commit bot
parent 2ae74af8f4
commit 8f1e31fe75
5 changed files with 53 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
src/compiler/js-native-context-specialization.cc
View File

@ -264,7 +264,7 @@ Reduction JSNativeContextSpecialization::ReduceNamedAccess(
1 << JSArrayBuffer::WasNeutered::kShift)),
jsgraph()->Int32Constant(0));
this_control =
graph()->NewNode(common()->DeoptimizeIf(), check, frame_state,
graph()->NewNode(common()->DeoptimizeUnless(), check, frame_state,
this_effect, this_control);
break;
}

13
test/mjsunit/compiler/optimized-float32array-length.js Normal file
View File

@ -0,0 +1,13 @@
// Copyright 2016 the V8 project authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
// Flags: --allow-natives-syntax
var a = new Float32Array(1);
function len(a) { return a.length; }
assertEquals(1, len(a));
assertEquals(1, len(a));
%OptimizeFunctionOnNextCall(len);
assertEquals(1, len(a));
assertOptimized(len);

13
test/mjsunit/compiler/optimized-float64array-length.js Normal file
View File

@ -0,0 +1,13 @@
// Copyright 2016 the V8 project authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
// Flags: --allow-natives-syntax
var a = new Float64Array(1);
function len(a) { return a.length; }
assertEquals(1, len(a));
assertEquals(1, len(a));
%OptimizeFunctionOnNextCall(len);
assertEquals(1, len(a));
assertOptimized(len);

13
test/mjsunit/compiler/optimized-int32array-length.js Normal file
View File

@ -0,0 +1,13 @@
// Copyright 2016 the V8 project authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
// Flags: --allow-natives-syntax
var a = new Int32Array(1);
function len(a) { return a.length; }
assertEquals(1, len(a));
assertEquals(1, len(a));
%OptimizeFunctionOnNextCall(len);
assertEquals(1, len(a));
assertOptimized(len);

13
test/mjsunit/compiler/optimized-uint32array-length.js Normal file
View File

@ -0,0 +1,13 @@
// Copyright 2016 the V8 project authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
// Flags: --allow-natives-syntax
var a = new Uint32Array(1);
function len(a) { return a.length; }
assertEquals(1, len(a));
assertEquals(1, len(a));
%OptimizeFunctionOnNextCall(len);
assertEquals(1, len(a));
assertOptimized(len);