AuroraMiddleware/v8
1
0
Fork 0
Code Issues 2 Pull Requests Releases Wiki Activity

[turbofan] Fix incorrect CheckNonEmptyString lowering.

Browse Source 
The CheckNonEmptyString lowering was the wrong way around and would
deoptimize if it doesn't see the empty string. This leads to the
creation of invalid ConsStrings and also to unnecessary deopt loops
with proper code.

Bug: chromium:947949, v8:8834, v8:8931, v8:8939, v8:8951
Change-Id: Ib2cc4e92cc9ec7e0284d94f74d14f67f8c878dec
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1545908
Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Commit-Queue: Benedikt Meurer <bmeurer@chromium.org>
Auto-Submit: Benedikt Meurer <bmeurer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#60542}
This commit is contained in:
Benedikt Meurer 2019-04-01 11:35:01 +02:00 committed by Commit Bot
parent 5fbc5015de
commit b3b7011867
3 changed files with 27 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
src/compiler/effect-control-linearizer.cc
View File

@ -1782,8 +1782,8 @@ Node* EffectControlLinearizer::LowerCheckNonEmptyString(Node* node,
// The empty string "" is canonicalized.
Node* check = __ WordEqual(value, __ EmptyStringConstant());
__ DeoptimizeIfNot(DeoptimizeReason::kWrongInstanceType, VectorSlotPair(),
check, frame_state);
__ DeoptimizeIf(DeoptimizeReason::kWrongInstanceType, VectorSlotPair(), check,
frame_state);
return value;
}

11
test/mjsunit/regress/regress-crbug-947949-1.js Normal file
View File

@ -0,0 +1,11 @@
// Copyright 2019 the V8 project authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
// Flags: --allow-natives-syntax --verify-heap
function foo(s) { return s + '0123456789012'; }
foo('a');
foo('\u1000');
%OptimizeFunctionOnNextCall(foo);
foo('');

14
test/mjsunit/regress/regress-crbug-947949-2.js Normal file
View File

@ -0,0 +1,14 @@
// Copyright 2019 the V8 project authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
// Flags: --allow-natives-syntax --noalways-opt --opt
function foo(s) { return s + '0123456789012'; }
foo('a');
foo('\u1000');
%OptimizeFunctionOnNextCall(foo);
foo('a');
assertOptimized(foo);
foo('');
assertUnoptimized(foo);