Status: Accepted
Owner: [email protected]
Labels: Type-Bug Priority-Medium
New issue 2192 by [email protected]: Polymorphic keyed store with
generic case is generated for a store into a preallocated array
http://code.google.com/p/v8/issues/detail?id=2192
--- start testcase ---
function map(array) {
var index = -1,
length = array.length,
result = new Array(array.length);
while (++index < length) {
result[index] = callback(array[index], index, array); // (*)
}
return result;
}
var array = [];
for (var i = 0; i < 200000; i++) {
array[i] = i;
}
function callback(value) {
return value * value;
}
map(array);
map(array);
map(array);
%OptimizeFunctionOnNextCall(map);
map(array);
--- end testcase ---
For a single keyed store marked (*) in the code above we generate very
complicated control flow that handles polymorphic case (why?) and contains
both(!) keyed store IC call (which inhibits all hoisting from the loop) and
a deoptimization... Hydrogen looks like this:
B8
0 0 v82 BlockEntry
0 2 i85 ElementsKind t41 range[-2147483648,2147483647,m0=0]
0 3 t86 LoadElements t41
0 0 v87 CompareConstantEqAndBranch i85 goto (B11, B9)
B9 <- B8 -> B10,B15 dom B8 [-1, -1] (loop 0 depth 1)
0 0 v102 BlockEntry
0 0 v103 CompareConstantEqAndBranch i85 goto (B10, B15)
B10 <- B9 -> B14 dom B9 [-1, -1] (loop 0 depth 1)
0 0 v104 BlockEntry
0 1 t121 Change i54 i to t range[-2147483647,2147483646,m0=0]
changes[NewSpacePromotion] type[number]
0 1 t125 Change d78 d to t changes[NewSpacePromotion]
type[heap-number]
0 0 v105 StoreKeyedGeneric t41[t121] = t125 changes[*]
0 0 v106 Simulate id=83 pop 3
0 0 v107 Goto B14
B11 <- B8 -> B13,B12 dom B8 [-1, -1] (loop 0 depth 1)
0 0 v88 BlockEntry
0 1 v89 HasInstanceTypeAndBranch t41 array
B12 <- B11 -> B14 dom B11 [-1, -1] (loop 0 depth 1)
0 0 v96 BlockEntry
0 1 t97 FixedArrayBaseLength t86
0 1 i126 Change t97 t to i range[-2147483648,2147483647,m0=0]
0 0 i98 BoundsCheck i54 i126 range[-2147483648,2147483647,m0=0]
0 0 v99 StoreKeyedFastDoubleElement t86[i54] = d78
changes[DoubleArrayElements]
0 0 v100 Simulate id=83 pop 3
0 0 v101 Goto B14
B13 <- B11 -> B14 dom B11 [-1, -1] (loop 0 depth 1)
0 0 v90 BlockEntry
0 1 t91 JSArrayLength t41 v89 type[smi]
0 1 i127 Change t91 t to i range[-2147483648,2147483647,m0=0]
0 0 i92 BoundsCheck i54 i127 range[-2147483648,2147483647,m0=0]
0 0 v93 StoreKeyedFastDoubleElement t86[i54] = d78
changes[DoubleArrayElements]
0 0 v94 Simulate id=83 pop 3
0 0 v95 Goto B14
B14 <- B13,B12,B10 -> B5 dom B8 [-1, -1] dom-loop-succ (loop 0 depth 1)
0 0 v110 BlockEntry
0 0 v111 Simulate id=83 push d78
0 0 v112 Simulate id=44 pop 1
0 0 v113 Goto B5
B15 <- B9 dom B9 [-1, -1]
0 0 v108 BlockEntry
0 0 v109 Deoptimize
--
v8-dev mailing list
[email protected]
http://groups.google.com/group/v8-dev
