Chromium Code Reviews
chromiumcodereview-hr@appspot.gserviceaccount.com (chromiumcodereview-hr) | Please choose your nickname with Settings | Help | Chromium Project | Gerrit Changes | Sign out
(255)

Unified Diff: src/hydrogen-check-elimination.cc

Issue 1000893003: Incorrect handling of HTransitionElementsKind in hydrogen check elimination phase fixed. (Closed) Base URL: https://chromium.googlesource.com/v8/v8.git@master
Patch Set: Created 5 years, 9 months ago
Use n/p to move between diff chunks; N/P to move between comments. Draft comments are only viewable by you.
Jump to:
View side-by-side diff with in-line comments
Download patch
« no previous file with comments | « no previous file | src/hydrogen-instructions.h » ('j') | no next file with comments »
Expand Comments ('e') | Collapse Comments ('c') | Show Comments Hide Comments ('s')
Index: src/hydrogen-check-elimination.cc
diff --git a/src/hydrogen-check-elimination.cc b/src/hydrogen-check-elimination.cc
index 3542fa601a0ee2e003cc3230ba1b5e2fc5063156..cdfedb4e51957c650e66980d0e47be4b50caf317 100644
--- a/src/hydrogen-check-elimination.cc
+++ b/src/hydrogen-check-elimination.cc
@@ -628,14 +628,23 @@ class HCheckTable : public ZoneObject {
HValue* object = instr->object()->ActualValue();
HCheckTableEntry* entry = Find(object);
// Can only learn more about an object that already has a known set of maps.
- if (entry == NULL) return;
+ if (entry == NULL) {
+ Kill(object);
+ return;
+ }
EnsureChecked(entry, object, instr);
if (entry->maps_->Contains(instr->original_map())) {
// If the object has the original map, it will be transitioned.
UniqueSet<Map>* maps = entry->maps_->Copy(zone());
maps->Remove(instr->original_map());
maps->Add(instr->transitioned_map(), zone());
- entry->maps_ = maps;
+ HCheckTableEntry::State state =
+ (entry->state_ == HCheckTableEntry::CHECKED_STABLE &&
+ instr->map_is_stable())
+ ? HCheckTableEntry::CHECKED_STABLE
+ : HCheckTableEntry::CHECKED;
+ Kill(object);
+ Insert(object, NULL, maps, state);
} else {
// Object does not have the given map, thus the transition is redundant.
instr->DeleteAndReplaceWith(object);
« no previous file with comments | « no previous file | src/hydrogen-instructions.h » ('j') | no next file with comments »

Powered by Google App Engine
This is Rietveld 408576698