[turbofan] Fix impossible type handling for TypeGuard and BooleanNot.

This also fixes incorrect type for fixed array accesses.

BUG=chromium:715651,v8:6309,chromium:715204

Review-Url: https://codereview.chromium.org/2848583002
Cr-Commit-Position: refs/heads/master@{#44926}
This commit is contained in:
jarin 2017-04-27 04:35:15 -07:00 committed by Commit bot
parent 9ceaf21272
commit ff2109d53e
4 changed files with 67 additions and 7 deletions

View File

@ -737,9 +737,9 @@ FieldAccess AccessBuilder::ForArgumentsCallee() {
FieldAccess AccessBuilder::ForFixedArraySlot(
size_t index, WriteBarrierKind write_barrier_kind) {
int offset = FixedArray::OffsetOfElementAt(static_cast<int>(index));
FieldAccess access = {kTaggedBase, offset,
Handle<Name>(), MaybeHandle<Map>(),
Type::NonInternal(), MachineType::AnyTagged(),
FieldAccess access = {kTaggedBase, offset,
Handle<Name>(), MaybeHandle<Map>(),
Type::Any(), MachineType::AnyTagged(),
write_barrier_kind};
return access;
}

View File

@ -1531,11 +1531,14 @@ class RepresentationSelector {
// BooleanNot(x: kRepBit) => Word32Equal(x, #0)
node->AppendInput(jsgraph_->zone(), jsgraph_->Int32Constant(0));
NodeProperties::ChangeOp(node, lowering->machine()->Word32Equal());
} else {
DCHECK(CanBeTaggedPointer(input_info->representation()));
} else if (CanBeTaggedPointer(input_info->representation())) {
// BooleanNot(x: kRepTagged) => WordEqual(x, #false)
node->AppendInput(jsgraph_->zone(), jsgraph_->FalseConstant());
NodeProperties::ChangeOp(node, lowering->machine()->WordEqual());
} else {
DCHECK_EQ(MachineRepresentation::kNone,
input_info->representation());
DeferReplacement(node, lowering->jsgraph()->Int32Constant(0));
}
} else {
// No input representation requirement; adapt during lowering.
@ -2779,9 +2782,15 @@ class RepresentationSelector {
// We just get rid of the sigma here. In principle, it should be
// possible to refine the truncation and representation based on
// the sigma's type.
MachineRepresentation output =
MachineRepresentation representation =
GetOutputInfoForPhi(node, TypeOf(node->InputAt(0)), truncation);
VisitUnop(node, UseInfo(output, truncation), output);
// For now, we just handle specially the impossible case.
MachineRepresentation output = TypeOf(node)->IsInhabited()
? representation
: MachineRepresentation::kNone;
VisitUnop(node, UseInfo(representation, truncation), output);
if (lower()) DeferReplacement(node, node->InputAt(0));
return;
}

View File

@ -0,0 +1,13 @@
// Copyright 2017 the V8 project authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
var global = true;
global = false;
function f() {
global = 1;
return !global;
}
f();

View File

@ -0,0 +1,38 @@
// Copyright 2017 the V8 project authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
// Flags: --allow-natives-syntax
function f() {
this.x = 1;
}
var a = [];
// Create enough objects to trigger slack tracking.
for (let i = 0; i < 100; i++) {
new f();
}
function h() {
// Create a new object and add an out-of-object property 'y'.
var o = new f();
o.y = 1.5;
return o;
}
function g(o) {
// Add more properties so that we trigger extension of out-ot-object
// property store.
o.u = 1.1;
o.v = 1.2;
o.z = 1.3;
// Return a field from the out-of-object-property store.
return o.y;
}
g(h());
g(h());
%OptimizeFunctionOnNextCall(g);
assertEquals(1.5, g(h()));