AuroraMiddleware/v8
1
0
Fork 0
Code Issues 2 Pull Requests Releases Wiki Activity

[turbofan] escape analysis: fix typing of new phi nodes

Browse Source 
Bug: chromium:744584
Change-Id: Ie25c2ba63e4764f359de38e53c2f3f3222877e0e
Reviewed-on: https://chromium-review.googlesource.com/577690
Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Commit-Queue: Tobias Tebbi <tebbi@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46792}
This commit is contained in:
Tobias Tebbi 2017-07-20 14:34:15 +02:00 committed by Commit Bot
parent 5f1157d350
commit a224eff455
3 changed files with 66 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
src/compiler/escape-analysis.cc
View File

@ -438,19 +438,16 @@ bool VirtualObject::MergeFields(size_t i, Node* at, MergeCache* cache,
int value_input_count = static_cast<int>(cache->fields().size());
Node* rep = GetField(i);
if (!rep || !IsCreatedPhi(i)) {
Type* phi_type = Type::None();
for (Node* input : cache->fields()) {
CHECK_NOT_NULL(input);
CHECK(!input->IsDead());
Type* input_type = NodeProperties::GetType(input);
phi_type = Type::Union(phi_type, input_type, graph->zone());
}
Node* control = NodeProperties::GetControlInput(at);
cache->fields().push_back(control);
Node* phi = graph->NewNode(
common->Phi(MachineRepresentation::kTagged, value_input_count),
value_input_count + 1, &cache->fields().front());
NodeProperties::SetType(phi, phi_type);
NodeProperties::SetType(phi, Type::Any());
SetField(i, phi, true);
#ifdef DEBUG

41
test/mjsunit/compiler/escape-analysis-phi-type-2.js Normal file
View File

@ -0,0 +1,41 @@
// Copyright 2017 the V8 project authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
// Flags: --allow-natives-syntax --turbo-escape
function f(x) {
var o = {a : 0, b: 0};
if (x == 0) {
o.a = 1
} else {
if (x <= 1) {
if (x == 2) {
o.a = 2;
} else {
o.a = 1
}
o.a = 2;
} else {
if (x == 2) {
o.a = "x";
} else {
o.a = "x";
}
o.b = 22;
}
o.b = 22;
}
return o.a + 1;
}
f(0,0);
f(1,0);
f(2,0);
f(3,0);
f(0,1);
f(1,1);
f(2,1);
f(3,1);
%OptimizeFunctionOnNextCall(f);
assertEquals(f(2), "x1");

24
test/mjsunit/compiler/escape-analysis-phi-type.js Normal file
View File

@ -0,0 +1,24 @@
// Copyright 2017 the V8 project authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
// Flags: --allow-natives-syntax --turbo-escape --turbo-experimental --no-turbo-loop-peeling
function f(x) {
var o = {a : 0};
var l = [1,2,3,4];
var res;
for (var i = 0; i < 3; ++i) {
if (x%2 == 0) { o.a = 1; b = false}
res = l[o.a];
o.a = x;
}
return res;
}
f(0);
f(1);
f(0);
f(1);
%OptimizeFunctionOnNextCall(f);
assertEquals(undefined, f(101));