AuroraMiddleware/v8
1
0
Fork 0
Code Issues 2 Pull Requests Releases Wiki Activity

[turboprop] Don't use dynamic map checks for array prototype loads

Browse Source 
For loads like Array.prototype.push, using dynamic map checks for
loading loading "push" from array prototype would prevent constant
folding of the push builtin. This would prevent inlining of these
builtins in the later phases. So, disable dynamic map checks when
loading fields from array prototype.

Bug: v8:10582
Change-Id: I8b44392a81194a3a5bd9b5ced6b1175658cec1f5
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2435367
Commit-Queue: Mythri Alle <mythria@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70171}
This commit is contained in:
Mythri A 2020-09-28 15:19:23 +01:00 committed by Commit Bot
parent 0f9bad146d
commit d11b97dd02
1 changed files with 15 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

18
src/compiler/js-heap-broker.cc
View File

@ -4689,11 +4689,22 @@ void FilterRelevantReceiverMaps(Isolate* isolate, MapHandles* maps) {
}
MaybeObjectHandle TryGetMinimorphicHandler(
std::vector<MapAndHandler> const& maps_and_handlers,
FeedbackSlotKind kind) {
std::vector<MapAndHandler> const& maps_and_handlers, FeedbackSlotKind kind,
Handle<NativeContext> native_context) {
if (!FLAG_dynamic_map_checks || !IsLoadICKind(kind))
return MaybeObjectHandle();
// Don't use dynamic map checks when loading properties from Array.prototype.
// Using dynamic map checks prevents constant folding and hence does not
// inline the array builtins. We only care about monomorphic cases here. For
// polymorphic loads currently we don't inline the builtins even without
// dynamic map checks.
if (maps_and_handlers.size() == 1 &&
*maps_and_handlers[0].first ==
native_context->initial_array_prototype().map()) {
return MaybeObjectHandle();
}
MaybeObjectHandle initial_handler;
for (MapAndHandler map_and_handler : maps_and_handlers) {
auto map = map_and_handler.first;
@ -4751,7 +4762,8 @@ ProcessedFeedback const& JSHeapBroker::ReadFeedbackForPropertyAccess(
base::Optional<NameRef> name =
static_name.has_value() ? static_name : GetNameFeedback(nexus);
MaybeObjectHandle handler = TryGetMinimorphicHandler(maps_and_handlers, kind);
MaybeObjectHandle handler = TryGetMinimorphicHandler(
maps_and_handlers, kind, target_native_context().object());
if (!handler.is_null()) {
MaybeHandle<Map> maybe_map;
if (nexus.ic_state() == MONOMORPHIC) {