Reviewers: danno,
Description:
Merged r16082 into 3.19 branch.
Fix Array index dehoisting.
BUG=264203
R=da...@chromium.org
Please review this at https://chromiumcodereview.appspot.com/22964003/
SVN Base: https://v8.googlecode.com/svn/branches/3.19
Affected files:
M src/hydrogen.cc
M src/version.cc
A + test/mjsunit/regress/regress-264203.js
Index: src/hydrogen.cc
diff --git a/src/hydrogen.cc b/src/hydrogen.cc
index
496dc88cb61a79faf599f3fdeb5d08eeada7b13a..9098571bd3f31a03b6a5fbcb9712addac8b405bd
100644
--- a/src/hydrogen.cc
+++ b/src/hydrogen.cc
@@ -4480,10 +4480,7 @@ static void
DehoistArrayIndex(ArrayInstructionInterface* array_operation) {
} else if (index->IsSub()) {
sign = -1;
HSub* sub = HSub::cast(index);
- if (sub->left()->IsConstant()) {
- subexpression = sub->right();
- constant = HConstant::cast(sub->left());
- } else if (sub->right()->IsConstant()) {
+ if (sub->right()->IsConstant()) {
subexpression = sub->left();
constant = HConstant::cast(sub->right());
} else {
Index: src/version.cc
diff --git a/src/version.cc b/src/version.cc
index
a064c36855d5ba514185a486dacc0bf92ea90586..44a39a0506b2c7144a1d2a6f97b6b4f493e907f0
100644
--- a/src/version.cc
+++ b/src/version.cc
@@ -35,7 +35,7 @@
#define MAJOR_VERSION 3
#define MINOR_VERSION 19
#define BUILD_NUMBER 18
-#define PATCH_LEVEL 18
+#define PATCH_LEVEL 19
// Use 1 for candidates and 0 otherwise.
// (Boolean macro values are not supported by all preprocessors.)
#define IS_CANDIDATE_VERSION 0
Index: test/mjsunit/regress/regress-264203.js
diff --git a/test/mjsunit/regress/regress-171641.js
b/test/mjsunit/regress/regress-264203.js
similarity index 89%
copy from test/mjsunit/regress/regress-171641.js
copy to test/mjsunit/regress/regress-264203.js
index
8db6781821325f8f6253eb2df4abb2b362b001c0..fa0075662575d85241b6af82c5945cca32938991
100644
--- a/test/mjsunit/regress/regress-171641.js
+++ b/test/mjsunit/regress/regress-264203.js
@@ -27,14 +27,18 @@
// Flags: --allow-natives-syntax
-function foo(k, p) {
- for (var i = 0; i < 1; i++) {
- p = Math.min(p, i);
+function foo(x) {
+ var a = [1, 2, 3, 4, 5, 6, 7, 8];
+ a[x + 5];
+ var result;
+ for (var i = 0; i < 3; i++) {
+ result = a[0 - x];
}
- m = Math.floor((k | 0) / p);
+ return result;
}
-foo(0, 1);
-foo(0, 1);
+foo(0);
+foo(0);
%OptimizeFunctionOnNextCall(foo);
-foo(0, 1);
+var r = foo(-2);
+assertEquals(3, r);
--
--
v8-dev mailing list
v8-dev@googlegroups.com
http://groups.google.com/group/v8-dev
---
You received this message because you are subscribed to the Google Groups "v8-dev" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to v8-dev+unsubscr...@googlegroups.com.
For more options, visit https://groups.google.com/groups/opt_out.
