Chromium Code Reviews
chromiumcodereview-hr@appspot.gserviceaccount.com (chromiumcodereview-hr) | Please choose your nickname with Settings | Help | Chromium Project | Gerrit Changes | Sign out
(72)

Side by Side Diff: src/compiler/js-global-object-specialization.cc

Issue 2508873002: [turbofan] Always install code dependency when optimizing a store to global property. (Closed)
Patch Set: Created 4 years, 1 month ago
Use n/p to move between diff chunks; N/P to move between comments. Draft comments are only viewable by you.
Jump to:
View unified diff | Download patch
« no previous file with comments | « no previous file | test/mjsunit/regress/regress-crbug-663750.js » ('j') | no next file with comments »
Toggle Intra-line Diffs ('i') | Expand Comments ('e') | Collapse Comments ('c') | Show Comments Hide Comments ('s')
OLDNEW
1 // Copyright 2015 the V8 project authors. All rights reserved. 1 // Copyright 2015 the V8 project authors. All rights reserved.
2 // Use of this source code is governed by a BSD-style license that can be 2 // Use of this source code is governed by a BSD-style license that can be
3 // found in the LICENSE file. 3 // found in the LICENSE file.
4 4
5 #include "src/compiler/js-global-object-specialization.h" 5 #include "src/compiler/js-global-object-specialization.h"
6 6
7 #include "src/compilation-dependencies.h" 7 #include "src/compilation-dependencies.h"
8 #include "src/compiler/access-builder.h" 8 #include "src/compiler/access-builder.h"
9 #include "src/compiler/common-operator.h" 9 #include "src/compiler/common-operator.h"
10 #include "src/compiler/js-graph.h" 10 #include "src/compiler/js-graph.h"
(...skipping 207 matching lines...) Expand 10 before | Expand all | Expand 10 after
218 property_cell_value_type = Type::SignedSmall(); 218 property_cell_value_type = Type::SignedSmall();
219 representation = MachineRepresentation::kTaggedSigned; 219 representation = MachineRepresentation::kTaggedSigned;
220 } 220 }
221 effect = graph()->NewNode( 221 effect = graph()->NewNode(
222 simplified()->StoreField(ForPropertyCellValue( 222 simplified()->StoreField(ForPropertyCellValue(
223 representation, property_cell_value_type, name)), 223 representation, property_cell_value_type, name)),
224 jsgraph()->HeapConstant(property_cell), value, effect, control); 224 jsgraph()->HeapConstant(property_cell), value, effect, control);
225 break; 225 break;
226 } 226 }
227 case PropertyCellType::kMutable: { 227 case PropertyCellType::kMutable: {
228 // Store to non-configurable, data property on the global can be lowered 228 // Record a code dependency on the cell, and just deoptimize if the
229 // to a field store, even without recording a code dependency on the cell, 229 // property ever becomes read-only.
230 // because the property cannot be deleted or reconfigured to an accessor 230 dependencies()->AssumePropertyCell(property_cell);
231 // or interceptor property.
232 if (property_details.IsConfigurable()) {
233 // Protect lowering by recording a code dependency on the cell.
234 dependencies()->AssumePropertyCell(property_cell);
235 }
236 effect = graph()->NewNode( 231 effect = graph()->NewNode(
237 simplified()->StoreField(ForPropertyCellValue( 232 simplified()->StoreField(ForPropertyCellValue(
238 MachineRepresentation::kTagged, Type::NonInternal(), name)), 233 MachineRepresentation::kTagged, Type::NonInternal(), name)),
239 jsgraph()->HeapConstant(property_cell), value, effect, control); 234 jsgraph()->HeapConstant(property_cell), value, effect, control);
240 break; 235 break;
241 } 236 }
242 } 237 }
243 ReplaceWithValue(node, value, effect, control); 238 ReplaceWithValue(node, value, effect, control);
244 return Replace(value); 239 return Replace(value);
245 } 240 }
(...skipping 32 matching lines...) Expand 10 before | Expand all | Expand 10 after
278 return jsgraph()->javascript(); 273 return jsgraph()->javascript();
279 } 274 }
280 275
281 SimplifiedOperatorBuilder* JSGlobalObjectSpecialization::simplified() const { 276 SimplifiedOperatorBuilder* JSGlobalObjectSpecialization::simplified() const {
282 return jsgraph()->simplified(); 277 return jsgraph()->simplified();
283 } 278 }
284 279
285 } // namespace compiler 280 } // namespace compiler
286 } // namespace internal 281 } // namespace internal
287 } // namespace v8 282 } // namespace v8
OLDNEW
« no previous file with comments | « no previous file | test/mjsunit/regress/regress-crbug-663750.js » ('j') | no next file with comments »

Powered by Google App Engine
This is Rietveld 408576698