AuroraMiddleware/v8
1
0
Fork 0
Code Issues 2 Pull Requests Releases Wiki Activity

[turbofan] Mark Array constructor calls as no-write if possible.

Browse Source 
If the new.target passed to the Array constructor cannot be a Proxy,
then we know that the Array constructor cannot trigger any observable
side-effects.

R=jarin@chromium.org
BUG=v8:6262

Review-Url: https://codereview.chromium.org/2821453002
Cr-Commit-Position: refs/heads/master@{#44645}
This commit is contained in:
bmeurer 2017-04-13 06:28:36 -07:00 committed by Commit bot
parent 5eec7df9b3
commit dc83caa6fb
1 changed files with 14 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

18
src/compiler/js-create-lowering.cc
View File

@ -598,6 +598,9 @@ Reduction JSCreateLowering::ReduceNewArrayToStubCall(
Node* node, Handle<AllocationSite> site) {
CreateArrayParameters const& p = CreateArrayParametersOf(node->op());
int const arity = static_cast<int>(p.arity());
Node* target = NodeProperties::GetValueInput(node, 0);
Node* new_target = NodeProperties::GetValueInput(node, 1);
Type* new_target_type = NodeProperties::GetType(new_target);
ElementsKind elements_kind = site->GetElementsKind();
AllocationSiteOverrideMode override_mode =
@ -605,12 +608,19 @@ Reduction JSCreateLowering::ReduceNewArrayToStubCall(
? DISABLE_ALLOCATION_SITES
: DONT_OVERRIDE;
// The Array constructor can only trigger an observable side-effect
// if the new.target may be a proxy.
Operator::Properties const properties =
(new_target != target || new_target_type->Maybe(Type::Proxy()))
? Operator::kNoDeopt
: Operator::kNoDeopt | Operator::kNoWrite;
if (arity == 0) {
ArrayNoArgumentConstructorStub stub(isolate(), elements_kind,
override_mode);
CallDescriptor* desc = Linkage::GetStubCallDescriptor(
isolate(), graph()->zone(), stub.GetCallInterfaceDescriptor(), 1,
CallDescriptor::kNeedsFrameState);
CallDescriptor::kNeedsFrameState, properties);
node->ReplaceInput(0, jsgraph()->HeapConstant(stub.GetCode()));
node->InsertInput(graph()->zone(), 2, jsgraph()->HeapConstant(site));
node->InsertInput(graph()->zone(), 3, jsgraph()->Constant(0));
@ -628,7 +638,7 @@ Reduction JSCreateLowering::ReduceNewArrayToStubCall(
override_mode);
CallDescriptor* desc = Linkage::GetStubCallDescriptor(
isolate(), graph()->zone(), stub.GetCallInterfaceDescriptor(), 2,
CallDescriptor::kNeedsFrameState);
CallDescriptor::kNeedsFrameState, properties);
node->ReplaceInput(0, jsgraph()->HeapConstant(stub.GetCode()));
node->InsertInput(graph()->zone(), 2, jsgraph()->HeapConstant(site));
node->InsertInput(graph()->zone(), 3, jsgraph()->Constant(1));
@ -655,7 +665,7 @@ Reduction JSCreateLowering::ReduceNewArrayToStubCall(
override_mode);
CallDescriptor* desc = Linkage::GetStubCallDescriptor(
isolate(), graph()->zone(), stub.GetCallInterfaceDescriptor(), 2,
CallDescriptor::kNeedsFrameState);
CallDescriptor::kNeedsFrameState, properties);
Node* inputs[] = {jsgraph()->HeapConstant(stub.GetCode()),
node->InputAt(1),
@ -678,7 +688,7 @@ Reduction JSCreateLowering::ReduceNewArrayToStubCall(
isolate(), GetHoleyElementsKind(elements_kind), override_mode);
CallDescriptor* desc = Linkage::GetStubCallDescriptor(
isolate(), graph()->zone(), stub.GetCallInterfaceDescriptor(), 2,
CallDescriptor::kNeedsFrameState);
CallDescriptor::kNeedsFrameState, properties);
Node* inputs[] = {jsgraph()->HeapConstant(stub.GetCode()),
node->InputAt(1),