Chromium Code Reviews
chromiumcodereview-hr@appspot.gserviceaccount.com (chromiumcodereview-hr) | Please choose your nickname with Settings | Help | Chromium Project | Gerrit Changes | Sign out
(173)

Unified Diff: src/hydrogen.cc

Issue 228883005: Avoid hydrogen compare-objects-equal assertions in dead code (Closed) Base URL: https://v8.googlecode.com/svn/branches/bleeding_edge
Patch Set: Changed the deopt from eager to soft Created 6 years, 8 months ago
Use n/p to move between diff chunks; N/P to move between comments. Draft comments are only viewable by you.
Jump to:
View side-by-side diff with in-line comments
Download patch
« no previous file with comments | « no previous file | test/mjsunit/regress/regress-359491.js » ('j') | no next file with comments »
Expand Comments ('e') | Collapse Comments ('c') | Show Comments Hide Comments ('s')
Index: src/hydrogen.cc
diff --git a/src/hydrogen.cc b/src/hydrogen.cc
index 8ce614fd660484efbc59f05e954b078d30acd6a9..309278703b59e4c34000df3c8c91169aef42893e 100644
--- a/src/hydrogen.cc
+++ b/src/hydrogen.cc
@@ -9846,6 +9846,17 @@ HControlInstruction* HOptimizedGraphBuilder::BuildCompareInstruction(
}
} else if (combined_type->Is(Type::InternalizedString()) &&
Token::IsEqualityOp(op)) {
+ // If we have a constant argument, it should be consistent with the type
+ // feedback (otherwise we fail assertions in HCompareObjectEqAndBranch).
+ if ((left->IsConstant() &&
+ !HConstant::cast(left)->HasInternalizedStringValue()) ||
+ (right->IsConstant() &&
+ !HConstant::cast(right)->HasInternalizedStringValue())) {
+ Add<HDeoptimize>("Type mismatch between feedback and constant",
+ Deoptimizer::SOFT);
+ // The caller expects a branch instruction, so make it happy.
+ return New<HBranch>(graph()->GetConstantTrue());
+ }
BuildCheckHeapObject(left);
Add<HCheckInstanceType>(left, HCheckInstanceType::IS_INTERNALIZED_STRING);
BuildCheckHeapObject(right);
@@ -9854,6 +9865,17 @@ HControlInstruction* HOptimizedGraphBuilder::BuildCompareInstruction(
New<HCompareObjectEqAndBranch>(left, right);
return result;
} else if (combined_type->Is(Type::String())) {
+ // If we have a constant argument, it should be consistent with the type
+ // feedback (otherwise we fail assertions in HCompareObjectEqAndBranch).
+ if ((left->IsConstant() &&
+ !HConstant::cast(left)->HasStringValue()) ||
+ (right->IsConstant() &&
+ !HConstant::cast(right)->HasStringValue())) {
+ Add<HDeoptimize>("Type mismatch between feedback and constant",
+ Deoptimizer::SOFT);
+ // The caller expects a branch instruction, so make it happy.
+ return New<HBranch>(graph()->GetConstantTrue());
+ }
BuildCheckHeapObject(left);
Add<HCheckInstanceType>(left, HCheckInstanceType::IS_STRING);
BuildCheckHeapObject(right);
« no previous file with comments | « no previous file | test/mjsunit/regress/regress-359491.js » ('j') | no next file with comments »

Powered by Google App Engine
This is Rietveld 408576698