1berry/nodejs
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

deps: cherry-pick 5005faed5 from V8 upstream

Browse Source 
Original commit message:

    [turbofan] Improve representation selection for type guard.

    This takes into account the type of the type guard when choosing
    representation for a node. To make the representation changes
    unambiguous, we pass the restricted type to the changer.

    BUG=chromium:726554

    Review-Url: https://codereview.chromium.org/2920193004
    Cr-Commit-Position: refs/heads/master@{#45734}

PR-URL: https://github.com/nodejs/node/pull/15177
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Michaël Zasso <targos@protonmail.com>
This commit is contained in:
Miguel Martins 2017-09-04 12:26:42 +01:00 committed by James M Snell
parent 9bae3eacc6
commit 81b2a89ad3
2 changed files with 50 additions and 12 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

35
deps/v8/src/compiler/simplified-lowering.cc vendored
View File

@ -734,7 +734,11 @@ class RepresentationSelector {
!GetUpperBound(node->InputAt(1))->Maybe(type);
}
void ConvertInput(Node* node, int index, UseInfo use) {
// Converts input {index} of {node} according to given UseInfo {use},
// assuming the type of the input is {input_type}. If {input_type} is null,
// it takes the input from the input node {TypeOf(node->InputAt(index))}.
void ConvertInput(Node* node, int index, UseInfo use,
Type* input_type = nullptr) {
Node* input = node->InputAt(index);
// In the change phase, insert a change before the use if necessary.
if (use.representation() == MachineRepresentation::kNone)
@ -752,8 +756,11 @@ class RepresentationSelector {
TRACE(" to ");
PrintUseInfo(use);
TRACE("\n");
if (input_type == nullptr) {
input_type = TypeOf(input);
}
Node* n = changer_->GetRepresentationFor(
input, input_info->representation(), TypeOf(input), node, use);
input, input_info->representation(), input_type, node, use);
node->ReplaceInput(index, n);
}
}
@ -2802,18 +2809,22 @@ class RepresentationSelector {
case IrOpcode::kObjectState:
return VisitObjectState(node);
case IrOpcode::kTypeGuard: {
// We just get rid of the sigma here. In principle, it should be
// possible to refine the truncation and representation based on
// the sigma's type.
// We just get rid of the sigma here, choosing the best representation
// for the sigma's type.
Type* type = TypeOf(node);
MachineRepresentation representation =
GetOutputInfoForPhi(node, TypeOf(node->InputAt(0)), truncation);
GetOutputInfoForPhi(node, type, truncation);
// For now, we just handle specially the impossible case.
MachineRepresentation output = TypeOf(node)->IsInhabited()
? representation
: MachineRepresentation::kNone;
VisitUnop(node, UseInfo(representation, truncation), output);
// Here we pretend that the input has the sigma's type for the
// conversion.
UseInfo use(representation, truncation);
if (propagate()) {
EnqueueInput(node, 0, use);
} else if (lower()) {
ConvertInput(node, 0, use, type);
}
ProcessRemainingInputs(node, 1);
SetOutput(node, representation);
if (lower()) DeferReplacement(node, node->InputAt(0));
return;
}

27
deps/v8/test/mjsunit/compiler/regress-726554.js vendored Normal file
View File

@ -0,0 +1,27 @@
// Copyright 2017 the V8 project authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
// Flags: --allow-natives-syntax
function h(a,b){
for(var i=0; i<a.length; i++) {h(a[i],b[i]); }
}
function g() {
h(arguments.length, 2);
}
function f() {
return g(1, 2);
}
b = [1,,];
b[1] = 3.5;
h(b, [1073741823, 2147483648, -12]);
f();
f();
%OptimizeFunctionOnNextCall(f);
f();