AuroraMiddleware/v8
1
0
Fork 0
Code Issues 2 Pull Requests Releases Wiki Activity

[turbofan] Pass new target to JSCreate nodes.

Browse Source 
This passes both, the actual constructor and the original constructor,
to nodes having the {JSCreate} operator. This is required for allocating
properly subclassed implicit receiver objects.

R=verwaest@chromium.org
BUG=v8:4544
LOG=n

Review URL: https://codereview.chromium.org/1434873004

Cr-Commit-Position: refs/heads/master@{#31955}
This commit is contained in:
mstarzinger 2015-11-12 01:33:27 -08:00 committed by Commit bot
parent 11d5d09ce1
commit bae4492a3e
4 changed files with 7 additions and 10 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
src/compiler/js-generic-lowering.cc
View File

@ -457,9 +457,6 @@ void JSGenericLowering::LowerJSLoadDynamic(Node* node) {
void JSGenericLowering::LowerJSCreate(Node* node) {
// TODO(4544): The duplication of the constructor function is only valid if
// actual constructor and original constructor coincide. Fix this!
node->InsertInput(zone(), 1, node->InputAt(0)); // Duplicate constructor.
ReplaceWithRuntimeCall(node, Runtime::kNewObject);
}

10
src/compiler/js-inlining.cc
View File

@ -452,12 +452,12 @@ Reduction JSInliner::ReduceJSCall(Node* node, Handle<JSFunction> function) {
if (node->opcode() == IrOpcode::kJSCallConstruct) {
Node* effect = NodeProperties::GetEffectInput(node);
Node* context = NodeProperties::GetContextInput(node);
Node* create = jsgraph_->graph()->NewNode(jsgraph_->javascript()->Create(),
call.target(), context, effect);
Node* create = jsgraph_->graph()->NewNode(
jsgraph_->javascript()->Create(), call.target(),
call.original_constructor(), context, effect);
NodeProperties::ReplaceEffectInput(node, create);
// TODO(4544): For now {JSCreate} requires the actual constructor to
// coincide with the original constructor. Adapt JSGenericLowering to fix.
// Also Runtime_GetOriginalConstructor depends on this for now. Fix as well!
// TODO(4544): For now Runtime_GetOriginalConstructor depends on the actual
// constructor to coincide with the original constructor. Fix this!
CHECK_EQ(call.target(), call.original_constructor());
// TODO(4544): For derived constructors we should not allocate an implicit
// receiver and also the return value should not be checked afterwards.

2
src/compiler/js-operator.cc
View File

@ -363,7 +363,7 @@ const CreateClosureParameters& CreateClosureParametersOf(const Operator* op) {
V(ToName, Operator::kNoProperties, 1, 1) \
V(ToObject, Operator::kNoProperties, 1, 1) \
V(Yield, Operator::kNoProperties, 1, 1) \
V(Create, Operator::kEliminatable, 1, 1) \
V(Create, Operator::kEliminatable, 2, 1) \
V(HasProperty, Operator::kNoProperties, 2, 1) \
V(TypeOf, Operator::kEliminatable, 1, 1) \
V(InstanceOf, Operator::kNoProperties, 2, 1) \

2
test/unittests/compiler/js-operator-unittest.cc
View File

@ -78,7 +78,7 @@ const SharedOperator kSharedOperators[] = {
SHARED(ToName, Operator::kNoProperties, 1, 1, 1, 1, 1, 1, 2),
SHARED(ToObject, Operator::kNoProperties, 1, 1, 1, 1, 1, 1, 2),
SHARED(Yield, Operator::kNoProperties, 1, 0, 1, 1, 1, 1, 2),
SHARED(Create, Operator::kEliminatable, 1, 0, 1, 0, 1, 1, 0),
SHARED(Create, Operator::kEliminatable, 2, 0, 1, 0, 1, 1, 0),
SHARED(HasProperty, Operator::kNoProperties, 2, 1, 1, 1, 1, 1, 2),
SHARED(TypeOf, Operator::kEliminatable, 1, 0, 1, 0, 1, 1, 0),
SHARED(InstanceOf, Operator::kNoProperties, 2, 1, 1, 1, 1, 1, 2),