Chromium Code Reviews
chromiumcodereview-hr@appspot.gserviceaccount.com (chromiumcodereview-hr) | Please choose your nickname with Settings | Help | Chromium Project | Gerrit Changes | Sign out
(421)

Unified Diff: src/hydrogen-instructions.h

Issue 1000893003: Incorrect handling of HTransitionElementsKind in hydrogen check elimination phase fixed. (Closed) Base URL: https://chromium.googlesource.com/v8/v8.git@master
Patch Set: Created 5 years, 9 months ago
Use n/p to move between diff chunks; N/P to move between comments. Draft comments are only viewable by you.
Jump to:
View side-by-side diff with in-line comments
Download patch
« no previous file with comments | « src/hydrogen-check-elimination.cc ('k') | test/mjsunit/regress/regress-460917.js » ('j') | no next file with comments »
Expand Comments ('e') | Collapse Comments ('c') | Show Comments Hide Comments ('s')
Index: src/hydrogen-instructions.h
diff --git a/src/hydrogen-instructions.h b/src/hydrogen-instructions.h
index bce610ab6a506709e6879aa2bb53bcca821e7e71..8f3b04acfb028534b449de14d79a843e4afe3b93 100644
--- a/src/hydrogen-instructions.h
+++ b/src/hydrogen-instructions.h
@@ -7297,8 +7297,13 @@ class HTransitionElementsKind FINAL : public HTemplateInstruction<2> {
HValue* context() const { return OperandAt(1); }
Unique<Map> original_map() const { return original_map_; }
Unique<Map> transitioned_map() const { return transitioned_map_; }
- ElementsKind from_kind() const { return from_kind_; }
- ElementsKind to_kind() const { return to_kind_; }
+ ElementsKind from_kind() const {
+ return FromElementsKindField::decode(bit_field_);
+ }
+ ElementsKind to_kind() const {
+ return ToElementsKindField::decode(bit_field_);
+ }
+ bool map_is_stable() const { return MapIsStableField::decode(bit_field_); }
std::ostream& PrintDataTo(std::ostream& os) const OVERRIDE; // NOLINT
@@ -7314,29 +7319,33 @@ class HTransitionElementsKind FINAL : public HTemplateInstruction<2> {
int RedefinedOperandIndex() OVERRIDE { return 0; }
private:
- HTransitionElementsKind(HValue* context,
- HValue* object,
+ HTransitionElementsKind(HValue* context, HValue* object,
Handle<Map> original_map,
Handle<Map> transitioned_map)
: original_map_(Unique<Map>(original_map)),
transitioned_map_(Unique<Map>(transitioned_map)),
- from_kind_(original_map->elements_kind()),
- to_kind_(transitioned_map->elements_kind()) {
+ bit_field_(
+ FromElementsKindField::encode(original_map->elements_kind()) |
+ ToElementsKindField::encode(transitioned_map->elements_kind()) |
+ MapIsStableField::encode(transitioned_map->is_stable())) {
SetOperandAt(0, object);
SetOperandAt(1, context);
SetFlag(kUseGVN);
SetChangesFlag(kElementsKind);
- if (!IsSimpleMapChangeTransition(from_kind_, to_kind_)) {
+ if (!IsSimpleMapChangeTransition(from_kind(), to_kind())) {
SetChangesFlag(kElementsPointer);
SetChangesFlag(kNewSpacePromotion);
}
set_representation(Representation::Tagged());
}
+ class FromElementsKindField : public BitField<ElementsKind, 0, 5> {};
+ class ToElementsKindField : public BitField<ElementsKind, 5, 5> {};
+ class MapIsStableField : public BitField<bool, 10, 1> {};
+
Unique<Map> original_map_;
Unique<Map> transitioned_map_;
- ElementsKind from_kind_;
- ElementsKind to_kind_;
+ uint32_t bit_field_;
};
« no previous file with comments | « src/hydrogen-check-elimination.cc ('k') | test/mjsunit/regress/regress-460917.js » ('j') | no next file with comments »

Powered by Google App Engine
This is Rietveld 408576698