AuroraMiddleware/v8
1
0
Fork 0
Code Issues 2 Pull Requests Releases Wiki Activity

[turbofan] Fix deopt for assignments in non-effect context.

Browse Source 
BUG=
R=mstarzinger@chromium.org

Review URL: https://codereview.chromium.org/701853002

Cr-Commit-Position: refs/heads/master@{#25151}
git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@25151 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
This commit is contained in:
jarin@chromium.org 2014-11-05 13:08:39 +00:00
parent 1b4c25e0b7
commit 91eeae5849
3 changed files with 34 additions and 10 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

20
src/compiler/ast-graph-builder.cc
View File

@ -1173,8 +1173,8 @@ void AstGraphBuilder::VisitAssignment(Assignment* expr) {
switch (assign_type) { switch (assign_type) {
case VARIABLE: { case VARIABLE: {
Variable* variable = expr->target()->AsVariableProxy()->var(); Variable* variable = expr->target()->AsVariableProxy()->var();
BuildVariableAssignment(variable, value, expr->op(), BuildVariableAssignment(variable, value, expr->op(), expr->AssignmentId(),
expr->AssignmentId()); ast_context()->GetStateCombine());
break; break;
} }
case NAMED_PROPERTY: { case NAMED_PROPERTY: {
@ -1183,7 +1183,8 @@ void AstGraphBuilder::VisitAssignment(Assignment* expr) {
MakeUnique(property->key()->AsLiteral()->AsPropertyName()); MakeUnique(property->key()->AsLiteral()->AsPropertyName());
Node* store = Node* store =
NewNode(javascript()->StoreNamed(strict_mode(), name), object, value); NewNode(javascript()->StoreNamed(strict_mode(), name), object, value);
PrepareFrameState(store, expr->AssignmentId()); PrepareFrameState(store, expr->AssignmentId(),
ast_context()->GetStateCombine());
break; break;
} }
case KEYED_PROPERTY: { case KEYED_PROPERTY: {
@ -1191,7 +1192,8 @@ void AstGraphBuilder::VisitAssignment(Assignment* expr) {
Node* object = environment()->Pop(); Node* object = environment()->Pop();
Node* store = NewNode(javascript()->StoreProperty(strict_mode()), object, Node* store = NewNode(javascript()->StoreProperty(strict_mode()), object,
key, value); key, value);
PrepareFrameState(store, expr->AssignmentId()); PrepareFrameState(store, expr->AssignmentId(),
ast_context()->GetStateCombine());
break; break;
} }
} }
@ -1957,9 +1959,9 @@ Node* AstGraphBuilder::BuildVariableDelete(
} }
Node* AstGraphBuilder::BuildVariableAssignment(Variable* variable, Node* value, Node* AstGraphBuilder::BuildVariableAssignment(
Token::Value op, Variable* variable, Node* value, Token::Value op, BailoutId bailout_id,
BailoutId bailout_id) { OutputFrameStateCombine combine) {
Node* the_hole = jsgraph()->TheHoleConstant(); Node* the_hole = jsgraph()->TheHoleConstant();
VariableMode mode = variable->mode(); VariableMode mode = variable->mode();
switch (variable->location()) { switch (variable->location()) {
@ -1969,7 +1971,7 @@ Node* AstGraphBuilder::BuildVariableAssignment(Variable* variable, Node* value,
Unique<Name> name = MakeUnique(variable->name()); Unique<Name> name = MakeUnique(variable->name());
const Operator* op = javascript()->StoreNamed(strict_mode(), name); const Operator* op = javascript()->StoreNamed(strict_mode(), name);
Node* store = NewNode(op, global, value); Node* store = NewNode(op, global, value);
PrepareFrameState(store, bailout_id); PrepareFrameState(store, bailout_id, combine);
return store; return store;
} }
case Variable::PARAMETER: case Variable::PARAMETER:
@ -2035,7 +2037,7 @@ Node* AstGraphBuilder::BuildVariableAssignment(Variable* variable, Node* value,
const Operator* op = const Operator* op =
javascript()->CallRuntime(Runtime::kStoreLookupSlot, 4); javascript()->CallRuntime(Runtime::kStoreLookupSlot, 4);
Node* store = NewNode(op, value, current_context(), name, strict); Node* store = NewNode(op, value, current_context(), name, strict);
PrepareFrameState(store, bailout_id); PrepareFrameState(store, bailout_id, combine);
return store; return store;
} }
} }

4
src/compiler/ast-graph-builder.h
View File

@ -80,7 +80,9 @@ class AstGraphBuilder : public StructuredGraphBuilder, public AstVisitor {
// Builders for variable load and assignment. // Builders for variable load and assignment.
Node* BuildVariableAssignment(Variable* var, Node* value, Token::Value op, Node* BuildVariableAssignment(Variable* var, Node* value, Token::Value op,
BailoutId bailout_id); BailoutId bailout_id,
OutputFrameStateCombine state_combine =
OutputFrameStateCombine::Ignore());
Node* BuildVariableDelete(Variable* var, BailoutId bailout_id, Node* BuildVariableDelete(Variable* var, BailoutId bailout_id,
OutputFrameStateCombine state_combine); OutputFrameStateCombine state_combine);
Node* BuildVariableLoad(Variable* var, BailoutId bailout_id, Node* BuildVariableLoad(Variable* var, BailoutId bailout_id,

20
test/mjsunit/regress/regress-assignment-in-test-context.js Normal file
View File

@ -0,0 +1,20 @@
// Copyright 2014 the V8 project authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
// Flags: --allow-natives-syntax --always-opt
// Flags: --turbo-filter=* --turbo-deoptimization
function assertEquals() {}
function f(o) {
if (o.setterProperty = 0) {
return 1;
}
return 2;
}
function deopt() { %DeoptimizeFunction(f); }
assertEquals(2,
f(Object.defineProperty({}, "setterProperty", { set: deopt })));