AuroraMiddleware/v8
1
0
Fork 0
Code Issues 2 Pull Requests Releases Wiki Activity

Insert HSimulate immediately after Crankshaft-inlined push.

Browse Source 
R=jarin@chromium.org
LOG=N

Review URL: https://codereview.chromium.org/247383002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@20889 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
This commit is contained in:
danno@chromium.org 2014-04-22 12:55:40 +00:00
parent 41bfa036b3
commit b4fa81dbca
2 changed files with 38 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

13
src/hydrogen.cc
View File

@ -7786,23 +7786,28 @@ bool HOptimizedGraphBuilder::TryInlineBuiltinMethodCall(
HValue* value_to_push = Pop(); HValue* value_to_push = Pop();
HValue* array = Pop(); HValue* array = Pop();
HValue* length = Add<HLoadNamedField>(array, static_cast<HValue*>(NULL), HInstruction* new_size = NULL;
HObjectAccess::ForArrayLength(elements_kind)); HValue* length = NULL;
{ {
NoObservableSideEffectsScope scope(this); NoObservableSideEffectsScope scope(this);
length = Add<HLoadNamedField>(array, static_cast<HValue*>(NULL),
HObjectAccess::ForArrayLength(elements_kind));
new_size = AddUncasted<HAdd>(length, graph()->GetConstant1());
bool is_array = receiver_map->instance_type() == JS_ARRAY_TYPE; bool is_array = receiver_map->instance_type() == JS_ARRAY_TYPE;
BuildUncheckedMonomorphicElementAccess(array, length, BuildUncheckedMonomorphicElementAccess(array, length,
value_to_push, is_array, value_to_push, is_array,
elements_kind, STORE, elements_kind, STORE,
NEVER_RETURN_HOLE, NEVER_RETURN_HOLE,
STORE_AND_GROW_NO_TRANSITION); STORE_AND_GROW_NO_TRANSITION);
Add<HSimulate>(expr->id(), REMOVABLE_SIMULATE);
} }
HInstruction* new_size = NewUncasted<HAdd>(length, Add<HConstant>(argc));
Drop(1); // Drop function. Drop(1); // Drop function.
ast_context()->ReturnInstruction(new_size, expr->id()); ast_context()->ReturnValue(new_size);
return true; return true;
} }
default: default:

29
test/mjsunit/array-push9.js Normal file
View File

@ -0,0 +1,29 @@
// Copyright 2014 the V8 project authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
// Flags: --allow-natives-syntax --deopt-every-n-times=5 --nodead-code-elimination
var array = [];
function push(array, value) {
array.push(value);
}
push(array, 0);
push(array, 1);
push(array, 2);
%OptimizeFunctionOnNextCall(push);
push(array, 3);
var v = 0;
Object.defineProperty(Array.prototype, "4", {
get: function() { return 100; },
set: function(value) { v = value; }
});
push(array, 4);
assertEquals(5, array.length);
assertEquals(100, array[4]);
assertEquals(4, v);