AuroraMiddleware/v8
1
0
Fork 0
Code Issues 2 Pull Requests Releases Wiki Activity

Fix representation inference for mutable double boxes.

Browse Source 
R=jarin@chromium.org
BUG=v8:3307
TEST=mjsunit/regress/regress-3307
LOG=N

Review URL: https://codereview.chromium.org/298723014

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@21467 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
This commit is contained in:
mstarzinger@chromium.org 2014-05-23 14:02:08 +00:00
parent 45ab7d5266
commit cf448aa15f
2 changed files with 29 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
src/hydrogen-instructions.h
View File

@ -714,6 +714,7 @@ class HValue : public ZoneObject {
if (r.IsTagged()) {
HType t = type();
if (t.IsSmi()) return Representation::Smi();
// TODO(mstarzinger): This is not correct for mutable HeapNumbers.
if (t.IsHeapNumber()) return Representation::Double();
if (t.IsHeapObject()) return r;
return Representation::None();
@ -5503,6 +5504,10 @@ class HAllocate V8_FINAL : public HTemplateInstruction<2> {
return Representation::Integer32();
}
}
// TODO(mstarzinger): Workaround until we track mutable HeapNumber types.
virtual Representation KnownOptimalRepresentation() V8_OVERRIDE {
return representation();
}
virtual Handle<Map> GetMonomorphicJSObjectMap() {
return known_initial_map_;

24
test/mjsunit/regress/regress-3307.js Normal file
View File

@ -0,0 +1,24 @@
// Copyright 2014 the V8 project authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
// Flags: --allow-natives-syntax
function p(x) {
this.x = x;
}
function f() {
var a = new p(1), b = new p(2);
for (var i = 0; i < 1; i++) {
a.x += b.x;
}
return a.x;
}
new p(0.1); // make 'x' mutable box double field in p.
assertEquals(3, f());
assertEquals(3, f());
%OptimizeFunctionOnNextCall(f);
assertEquals(3, f());