AuroraMiddleware/v8
1
0
Fork 0
Code Issues 2 Pull Requests Releases Wiki Activity

[tests] Fix mjsunit/getters-on-elements

Browse Source 
Give the IC one more chance to get itself into a state that's in
line with Turbofan's capabilities and the following assertOptimized
expectation.

BUG=v8:6101,v8:6325

Review-Url: https://codereview.chromium.org/2848193003
Cr-Commit-Position: refs/heads/master@{#45020}
This commit is contained in:
jkummerow 2017-05-02 03:41:38 -07:00 committed by Commit bot
parent c63f1051e3
commit d5401cb225
3 changed files with 23 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
src/runtime/runtime-test.cc
View File

@ -165,6 +165,7 @@ RUNTIME_FUNCTION(Runtime_DeoptimizeFunction) {
return isolate->heap()->undefined_value();
}
Handle<JSFunction> function = Handle<JSFunction>::cast(function_object);
function->shared()->set_marked_for_tier_up(false);
// If the function is not optimized, just return.
if (!function->IsOptimized()) return isolate->heap()->undefined_value();

23
test/mjsunit/getters-on-elements.js
View File

@ -78,17 +78,38 @@ function base_getter_test(create_func) {
foo(a);
assertUnoptimized(foo);
// Smi and Double elements transition the KeyedLoadIC to Generic state
// here, because they miss twice with the same map when loading the hole.
// For FAST_HOLEY_ELEMENTS, however, the IC knows how to convert the hole
// to undefined if the prototype is the original array prototype, so it
// stays monomorphic for now...
foo(a);
foo(a);
delete a[0];
assertEquals(0, calls);
a.__proto__ = ap;
// ...and later becomes polymorphic when it sees a second map. Optimized
// code will therefore inline the elements access, and deopt right away
// when it loads the hole from index [0].
// Possible solutions:
// - remove the convert_hole_to_undefined flag from the IC, to force it
// into generic state for all elements kinds. Cost: slower ICs in code
// that doesn't get optimized.
// - teach Turbofan about the same trick: for holey elements with the
// original array prototype, convert hole to undefined inline. Cost:
// larger optimized code size, because the loads for different maps with
// the same elements kind can no longer be consolidated if they handle
// the hole differently.
// - call "foo" twice after setting a.__proto__ and before optimizing it;
// this is the simplest fix so let's do that for now.
foo(a);
assertEquals(1, calls);
optimize(foo);
foo(a);
assertEquals(2, calls);
optimize(foo);
foo(a);
assertEquals(3, calls);
assertOptimized(foo);
// Testcase: getter "deep" in prototype chain.

3
test/mjsunit/mjsunit.status
View File

@ -186,9 +186,6 @@
# which makes the test useless.
'big-object-literal': [PASS, ['mode == debug', SKIP]],
# BUG(v8:6101): This fails because of a hole deopt, need to investigate.
'getters-on-elements': [SKIP],
# BUG(v8:6113).
'es6/array-iterator-turbo': [SKIP],