Chromium Code Reviews
chromiumcodereview-hr@appspot.gserviceaccount.com (chromiumcodereview-hr) | Please choose your nickname with Settings | Help | Chromium Project | Gerrit Changes | Sign out
(290)

Unified Diff: src/hydrogen.cc

Issue 1087463003: Fix indirect push (Closed) Base URL: https://chromium.googlesource.com/v8/v8.git@master
Patch Set: Created 5 years, 8 months ago
Use n/p to move between diff chunks; N/P to move between comments. Draft comments are only viewable by you.
Jump to:
View side-by-side diff with in-line comments
Download patch
« no previous file with comments | « no previous file | test/mjsunit/regress/regress-indirect-push-unchecked.js » ('j') | no next file with comments »
Expand Comments ('e') | Collapse Comments ('c') | Show Comments Hide Comments ('s')
Index: src/hydrogen.cc
diff --git a/src/hydrogen.cc b/src/hydrogen.cc
index b9e032487defd50f182da1aaf35f90a80bcb7f3b..138cf1877ae5f7b8b01102b86a18f181b6055469 100644
--- a/src/hydrogen.cc
+++ b/src/hydrogen.cc
@@ -2388,6 +2388,8 @@ HInstruction* HGraphBuilder::BuildUncheckedMonomorphicElementAccess(
PropertyAccessType access_type,
LoadKeyedHoleMode load_mode,
KeyedAccessStoreMode store_mode) {
+ DCHECK(top_info()->IsStub() || checked_object->IsCompareMap() ||
+ checked_object->IsCheckMaps());
DCHECK((!IsExternalArrayElementsKind(elements_kind) &&
!IsFixedTypedArrayElementsKind(elements_kind)) ||
!is_js_array);
@@ -8447,11 +8449,10 @@ bool HOptimizedGraphBuilder::TryInlineBuiltinMethodCall(
new_size = AddUncasted<HAdd>(length, graph()->GetConstant1());
bool is_array = receiver_map->instance_type() == JS_ARRAY_TYPE;
- BuildUncheckedMonomorphicElementAccess(array, length,
- value_to_push, is_array,
- elements_kind, STORE,
- NEVER_RETURN_HOLE,
- STORE_AND_GROW_NO_TRANSITION);
+ HValue* checked_array = Add<HCheckMaps>(array, receiver_map);
+ BuildUncheckedMonomorphicElementAccess(
+ checked_array, length, value_to_push, is_array, elements_kind,
+ STORE, NEVER_RETURN_HOLE, STORE_AND_GROW_NO_TRANSITION);
if (!ast_context()->IsEffect()) Push(new_size);
Add<HSimulate>(expr->id(), REMOVABLE_SIMULATE);
@@ -8818,18 +8819,9 @@ void HOptimizedGraphBuilder::HandleIndirectCall(Call* expr, HValue* function,
int args_count_no_receiver = arguments_count - 1;
if (function->IsConstant() &&
HConstant::cast(function)->handle(isolate())->IsJSFunction()) {
- HValue* receiver = environment()->ExpressionStackAt(args_count_no_receiver);
- Handle<Map> receiver_map;
- if (receiver->IsConstant() &&
- HConstant::cast(receiver)->handle(isolate())->IsHeapObject()) {
- receiver_map =
- handle(Handle<HeapObject>::cast(
- HConstant::cast(receiver)->handle(isolate()))->map());
- }
-
known_function =
Handle<JSFunction>::cast(HConstant::cast(function)->handle(isolate()));
- if (TryInlineBuiltinMethodCall(expr, known_function, receiver_map,
+ if (TryInlineBuiltinMethodCall(expr, known_function, Handle<Map>(),
args_count_no_receiver)) {
if (FLAG_trace_inlining) {
PrintF("Inlining builtin ");
« no previous file with comments | « no previous file | test/mjsunit/regress/regress-indirect-push-unchecked.js » ('j') | no next file with comments »

Powered by Google App Engine
This is Rietveld 408576698