AuroraMiddleware/v8
1
0
Fork 0
Code Issues 2 Pull Requests Releases Wiki Activity

Fix map check removal issue in r13488.

Browse Source 
The removal of HCheckMaps is invalid when the instruction has a virtual
usage, which can happen e.g. for HLoadElements or HJSArrayLength.

R=jkummerow@chromium.org
TEST=webkit:fast/js/regress/Float32Array-matrix-mult.html

Review URL: https://codereview.chromium.org/12033073

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13491 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
This commit is contained in:
mstarzinger@chromium.org 2013-01-24 12:35:56 +00:00
parent e6224d275f
commit ef4d9d1245
1 changed files with 1 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
src/hydrogen-instructions.cc
View File

@ -1173,7 +1173,7 @@ void HCheckMaps::SetSideEffectDominator(GVNFlag side_effect,
// TODO(mstarzinger): For now we specialize on HStoreNamedField, but once // TODO(mstarzinger): For now we specialize on HStoreNamedField, but once
// type information is rich enough we should generalize this to any HType // type information is rich enough we should generalize this to any HType
// for which the map is known. // for which the map is known.
if (dominator->IsStoreNamedField()) { if (HasNoUses() && dominator->IsStoreNamedField()) {
HStoreNamedField* store = HStoreNamedField::cast(dominator); HStoreNamedField* store = HStoreNamedField::cast(dominator);
Handle<Map> map = store->transition(); Handle<Map> map = store->transition();
if (map.is_null() || store->object() != value()) return; if (map.is_null() || store->object() != value()) return;