AuroraMiddleware/v8
1
0
Fork 0
Code Issues 2 Pull Requests Releases Wiki Activity

[turbofan] Temporarily disable write barrier elimination for stores of small integers.

Browse Source 
The proper fix would be to make TruncatingUseInfoFromRepresentation
respect tagged signed use representation, but requires extra work
to refine typing for all values that are stored into Smi fields.

Bug: chromium:791245
Change-Id: I83965bcc18a836d2c758a6a8b1477a4aa2c6133d
Reviewed-on: https://chromium-review.googlesource.com/808866
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Commit-Queue: Jaroslav Sevcik <jarin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49870}
This commit is contained in:
Jaroslav Sevcik 2017-12-05 14:56:48 +01:00 committed by Commit Bot
parent 23276bd250
commit f8834852a9
2 changed files with 17 additions and 12 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

12
src/compiler/simplified-lowering.cc
View File

@ -2547,12 +2547,6 @@ class RepresentationSelector {
MachineRepresentation field_representation =
access.machine_type.representation();
// Make sure we convert to Smi if possible. This should help write
// barrier elimination.
if (field_representation == MachineRepresentation::kTagged &&
TypeOf(value_node)->Is(Type::SignedSmall())) {
field_representation = MachineRepresentation::kTaggedSigned;
}
WriteBarrierKind write_barrier_kind = WriteBarrierKindFor(
access.base_is_tagged, field_representation, access.offset,
access.type, input_info->representation(), value_node);
@ -2586,12 +2580,6 @@ class RepresentationSelector {
MachineRepresentation element_representation =
access.machine_type.representation();
// Make sure we convert to Smi if possible. This should help write
// barrier elimination.
if (element_representation == MachineRepresentation::kTagged &&
TypeOf(value_node)->Is(Type::SignedSmall())) {
element_representation = MachineRepresentation::kTaggedSigned;
}
WriteBarrierKind write_barrier_kind = WriteBarrierKindFor(
access.base_is_tagged, element_representation, access.type,
input_info->representation(), value_node);

17
test/mjsunit/compiler/regress-791245.js Normal file
View File

@ -0,0 +1,17 @@
// Copyright 2017 the V8 project authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
// Flags: --expose-gc
var a, b; // Global variables that will end up with number map.
for (var i = 0; i < 100000; i++) {
b = 1;
a = i + -0; // -0 is a number, so this will make "a" a heap object.
b = a;
}
assertTrue(a === b);
gc();
assertTrue(a === b);