AuroraMiddleware/v8
1
0
Fork 0
Code Issues 2 Pull Requests Releases Wiki Activity

[turbofan] Extend the type fixup to LoadField as well.

Browse Source 
For LoadElimination we must not replace LoadField nodes with other nodes
whose types are not a subtype of the original LoadField type, as that
breaks the verifier. We already fixed that earlier for store to load
forwarding, but the fix didn't cover LoadField forwarding.

This actually still generates the correct code even w/o the fix, but
since recently fails due to stronger checking in representation
selection. So this makes clusterfuzz happy again.

R=mvstanton@chromium.org
BUG=chromium:607899
LOG=n

Review-Url: https://codereview.chromium.org/1934973002
Cr-Commit-Position: refs/heads/master@{#35930}
This commit is contained in:
bmeurer 2016-05-02 04:28:35 -07:00 committed by Commit bot
parent 4aa02441da
commit c0e65ea85d
1 changed files with 2 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
src/compiler/load-elimination.cc
View File

@ -34,8 +34,9 @@ Reduction LoadElimination::ReduceLoadField(Node* node) {
effect = NodeProperties::GetEffectInput(effect)) {
switch (effect->opcode()) {
case IrOpcode::kLoadField: {
FieldAccess const effect_access = FieldAccessOf(effect->op());
if (object == NodeProperties::GetValueInput(effect, 0) &&
access == FieldAccessOf(effect->op())) {
access == effect_access && effect_access.type->Is(access.type)) {
Node* const value = effect;
ReplaceWithValue(node, value);
return Replace(value);