AuroraMiddleware/v8
1
0
Fork 0
Code Issues 2 Pull Requests Releases Wiki Activity

Fix for performance issue 353661 - 23% regression in dromaeo.

Browse Source 
The issue was that a previous fix to avoid a logic error was not
targeted enough: it allowed non-transitioning stores to fall
into a code path meant to preserve monomorphic state in the
case of a transitioning store.

BUG=353661
LOG=N
R=verwaest@chromium.org

Review URL: https://codereview.chromium.org/206353002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@20127 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
This commit is contained in:
mvstanton@chromium.org 2014-03-20 13:38:08 +00:00
parent e9358fa9ce
commit c92de5d189
1 changed files with 2 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
src/ic.cc
View File

@ -1452,7 +1452,8 @@ Handle<Code> KeyedStoreIC::StoreElementStub(Handle<JSObject> receiver,
if (IsTransitionStoreMode(store_mode)) { if (IsTransitionStoreMode(store_mode)) {
transitioned_receiver_map = ComputeTransitionedMap(receiver, store_mode); transitioned_receiver_map = ComputeTransitionedMap(receiver, store_mode);
} }
if (receiver_map.is_identical_to(previous_receiver_map) || if ((receiver_map.is_identical_to(previous_receiver_map) &&
IsTransitionStoreMode(store_mode)) ||
IsTransitionOfMonomorphicTarget( IsTransitionOfMonomorphicTarget(
MapToType<HeapType>(transitioned_receiver_map, isolate()))) { MapToType<HeapType>(transitioned_receiver_map, isolate()))) {
// If the "old" and "new" maps are in the same elements map family, or // If the "old" and "new" maps are in the same elements map family, or