Reviewers: Hannes Payer,
Message:
PTAL
Description:
Fix handling of constant global variable assignments.
BUG=347904
LOG=y
Please review this at https://codereview.chromium.org/184303003/
SVN Base: https://v8.googlecode.com/svn/branches/bleeding_edge
Affected files (+23, -15 lines):
M src/hydrogen.cc
A + test/mjsunit/regress/regress-347904.js
Index: src/hydrogen.cc
diff --git a/src/hydrogen.cc b/src/hydrogen.cc
index
6bc7f6982fb798f442eb5a55da8b380ac7868d0c..cc74869d5db04a93a3f64af3f4988ae9b9c148db
100644
--- a/src/hydrogen.cc
+++ b/src/hydrogen.cc
@@ -5909,18 +5909,25 @@ void
HOptimizedGraphBuilder::HandleGlobalVariableAssignment(
Handle<GlobalObject> global(current_info()->global_object());
Handle<PropertyCell> cell(global->GetPropertyCell(&lookup));
if (cell->type()->IsConstant()) {
- IfBuilder builder(this);
HValue* constant = Add<HConstant>(cell->type()->AsConstant());
- if (cell->type()->AsConstant()->IsNumber()) {
- builder.If<HCompareNumericAndBranch>(value, constant, Token::EQ);
+ if (value->IsConstant()) {
+ if (value->Equals(constant)) {
+ Add<HDeoptimize>("Constant global variable assignment",
+ Deoptimizer::EAGER);
+ }
} else {
- builder.If<HCompareObjectEqAndBranch>(value, constant);
+ IfBuilder builder(this);
+ if (cell->type()->AsConstant()->IsNumber()) {
+ builder.If<HCompareNumericAndBranch>(value, constant, Token::EQ);
+ } else {
+ builder.If<HCompareObjectEqAndBranch>(value, constant);
+ }
+ builder.Then();
+ builder.Else();
+ Add<HDeoptimize>("Constant global variable assignment",
+ Deoptimizer::EAGER);
+ builder.End();
}
- builder.Then();
- builder.Else();
- Add<HDeoptimize>("Constant global variable assignment",
- Deoptimizer::EAGER);
- builder.End();
}
HInstruction* instr =
Add<HStoreGlobalCell>(value, cell, lookup.GetPropertyDetails());
Index: test/mjsunit/regress/regress-347904.js
diff --git a/test/mjsunit/regress/regress-crbug-346141.js
b/test/mjsunit/regress/regress-347904.js
similarity index 55%
copy from test/mjsunit/regress/regress-crbug-346141.js
copy to test/mjsunit/regress/regress-347904.js
index
798b7704ec2cc0eb928966fdfe9f979d0fe51f94..1a27b054a4b89b8e8841c9311f1c155aea7ce4d7
100644
--- a/test/mjsunit/regress/regress-crbug-346141.js
+++ b/test/mjsunit/regress/regress-347904.js
@@ -2,10 +2,11 @@
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
-// Flags: --harmony-symbols
+// Flags: --allow-natives-syntax --stress-runs=2
-var s = Symbol()
-var o = {}
-o[s] = 2
-o[""] = 3
-Object.getOwnPropertySymbols(o)
+var v = /abc/;
+function f() {
+ v = 1578221999;
+};
+%OptimizeFunctionOnNextCall(f);
+f();
--
--
v8-dev mailing list
[email protected]
http://groups.google.com/group/v8-dev
---
You received this message because you are subscribed to the Google Groups "v8-dev" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
For more options, visit https://groups.google.com/groups/opt_out.
