AuroraMiddleware/v8
1
0
Fork 0
Code Issues 2 Pull Requests Releases Wiki Activity

[turbofan] Add dedicated test for check constant folding.

Browse Source 
This adds a dedicated test to make sure we don't try constant folding on
checks (in this case CheckTaggedPointer), which would generate invalid
code as we removing checks that guard the constant without knowing
whether it's safe to do so.

R=jarin@chromium.org

Review-Url: https://codereview.chromium.org/2087153002
Cr-Commit-Position: refs/heads/master@{#37168}
This commit is contained in:
bmeurer 2016-06-22 01:18:57 -07:00 committed by Commit bot
parent c30b854aa3
commit a334354288
2 changed files with 14 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
src/compiler/js-typed-lowering.cc
View File

@ -1853,6 +1853,10 @@ Reduction JSTypedLowering::Reduce(Node* node) {
// result value and can simply replace the node if it's eliminable.
if (!NodeProperties::IsConstant(node) && NodeProperties::IsTyped(node) &&
node->op()->HasProperty(Operator::kEliminatable)) {
// We can only constant-fold nodes here, that are known to not cause any
// side-effect, may it be a JavaScript observable side-effect or a possible
// eager deoptimization exit (i.e. {node} has an operator that doesn't have
// the Operator::kNoDeopt property).
Type* upper = NodeProperties::GetType(node);
if (upper->IsInhabited()) {
if (upper->IsConstant()) {

10
test/mjsunit/compiler/dont-constant-fold-deopting-checks.js Normal file
View File

@ -0,0 +1,10 @@
// Copyright 2016 the V8 project authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
// Flags: --allow-natives-syntax
function bar(a) { a[0](true); }
function foo(a) { return bar(1); }
%OptimizeFunctionOnNextCall(foo);
assertThrows(function() {bar([foo])}, TypeError);