AuroraMiddleware/v8
1
0
Fork 0
Code Issues 2 Pull Requests Releases Wiki Activity

[turbofan] Don't assume we have receiver maps in preprocessed feedback

Browse Source 
This was an oversight in my previous CL.

Bug: chromium:936077, v8:7790
Change-Id: Ic1034c1754d10c72df8f61d1e2c34333e1565e3e
Reviewed-on: https://chromium-review.googlesource.com/c/1491222
Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Commit-Queue: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#59923}
This commit is contained in:
Georg Neis 2019-02-27 11:19:24 +01:00 committed by Commit Bot
parent 8308ba0864
commit 9c5cd06611
2 changed files with 19 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
src/compiler/access-info.cc
View File

@ -282,6 +282,8 @@ bool AccessInfoFactory::ComputeElementAccessInfos(
}
}
if (processed.receiver_maps.empty()) return false;
if (access_mode == AccessMode::kLoad) {
// For polymorphic loads of similar elements kinds (i.e. all tagged or all
// double), always use the "worst case" code without a transition. This is

17
test/mjsunit/regress/regress-936077.js Normal file
View File

@ -0,0 +1,17 @@
// Copyright 2019 the V8 project authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
// Flags: --expose-gc --allow-natives-syntax
// Flags: --concurrent-inlining --function-context-specialization
function main() {
var obj = {};
function foo() { return obj[0]; };
gc();
obj.x = 10;
%OptimizeFunctionOnNextCall(foo);
foo();
}
main();
main();