Chromium Code Reviews
chromiumcodereview-hr@appspot.gserviceaccount.com (chromiumcodereview-hr) | Please choose your nickname with Settings | Help | Chromium Project | Gerrit Changes | Sign out
(89)

Unified Diff: src/compiler/js-native-context-specialization.cc

Issue 2890363002: Fix deoptmization of inlined TF InstanceOf to call ToBoolean (Closed)
Patch Set: Review feedback Created 3 years, 6 months ago
Use n/p to move between diff chunks; N/P to move between comments. Draft comments are only viewable by you.
Jump to:
View side-by-side diff with in-line comments
Download patch
« no previous file with comments | « src/compiler/frame-states.cc ('k') | src/deoptimizer.cc » ('j') | no next file with comments »
Expand Comments ('e') | Collapse Comments ('c') | Show Comments Hide Comments ('s')
Index: src/compiler/js-native-context-specialization.cc
diff --git a/src/compiler/js-native-context-specialization.cc b/src/compiler/js-native-context-specialization.cc
index 73db511256be08708d6c70feebc2610c56e57861..43e19ab1fca0d9b9050aad6a5beff83db8a72439 100644
--- a/src/compiler/js-native-context-specialization.cc
+++ b/src/compiler/js-native-context-specialization.cc
@@ -175,6 +175,7 @@ Reduction JSNativeContextSpecialization::ReduceJSInstanceOf(Node* node) {
Node* constructor = NodeProperties::GetValueInput(node, 1);
Node* context = NodeProperties::GetContextInput(node);
Node* effect = NodeProperties::GetEffectInput(node);
+ Node* frame_state = NodeProperties::GetFrameStateInput(node);
Node* control = NodeProperties::GetControlInput(node);
// Check if the right hand side is a known {receiver}.
@@ -244,11 +245,22 @@ Reduction JSNativeContextSpecialization::ReduceJSInstanceOf(Node* node) {
effect = BuildCheckMaps(constructor, effect, control,
access_info.receiver_maps());
+ // Create a nested frame state inside the current method's most-recent frame
+ // state that will ensure that deopts that happen after this point will not
+ // fallback to the last Checkpoint--which would completely re-execute the
+ // instanceof logic--but rather create an activation of a version of the
+ // ToBoolean stub that finishes the remaining work of instanceof and returns
+ // to the caller without duplicating side-effects upon a lazy deopt.
+ Node* continuation_frame_state = CreateStubBuiltinContinuationFrameState(
+ jsgraph(), Builtins::kToBooleanLazyDeoptContinuation, context, nullptr,
+ 0, frame_state, ContinuationFrameStateMode::LAZY);
+
// Call the @@hasInstance handler.
Node* target = jsgraph()->Constant(constant);
node->InsertInput(graph()->zone(), 0, target);
node->ReplaceInput(1, constructor);
node->ReplaceInput(2, object);
+ node->ReplaceInput(4, continuation_frame_state);
node->ReplaceInput(5, effect);
NodeProperties::ChangeOp(
node, javascript()->Call(3, CallFrequency(), VectorSlotPair(),
« no previous file with comments | « src/compiler/frame-states.cc ('k') | src/deoptimizer.cc » ('j') | no next file with comments »

Powered by Google App Engine
This is Rietveld 408576698