Reviewers: danno,
Description:
Merged r19591, r19599 into trunk branch.
HAllocate should never generate allocation code if the requested size does
not
fit into page. Regression test included.
Fix representation generalization for doubles.
BUG=347543
LOG=N
[email protected]
Please review this at https://codereview.chromium.org/181183007/
SVN Base: https://v8.googlecode.com/svn/trunk
Affected files (+32, -23 lines):
M src/arm/lithium-codegen-arm.cc
M src/ia32/lithium-codegen-ia32.cc
M src/mips/lithium-codegen-mips.cc
M src/property-details.h
M src/version.cc
M src/x64/lithium-codegen-x64.cc
A + test/mjsunit/regress/regress-347909.js
Index: src/arm/lithium-codegen-arm.cc
diff --git a/src/arm/lithium-codegen-arm.cc b/src/arm/lithium-codegen-arm.cc
index
dde402303aef709c0f4b06e43003bff22448eb22..05348bf018e87011280699e649b43d96bc167cf1
100644
--- a/src/arm/lithium-codegen-arm.cc
+++ b/src/arm/lithium-codegen-arm.cc
@@ -5249,7 +5249,11 @@ void LCodeGen::DoAllocate(LAllocate* instr) {
if (instr->size()->IsConstantOperand()) {
int32_t size = ToInteger32(LConstantOperand::cast(instr->size()));
- __ Allocate(size, result, scratch, scratch2, deferred->entry(), flags);
+ if (size <= Page::kMaxRegularHeapObjectSize) {
+ __ Allocate(size, result, scratch, scratch2, deferred->entry(),
flags);
+ } else {
+ __ jmp(deferred->entry());
+ }
} else {
Register size = ToRegister(instr->size());
__ Allocate(size,
Index: src/ia32/lithium-codegen-ia32.cc
diff --git a/src/ia32/lithium-codegen-ia32.cc
b/src/ia32/lithium-codegen-ia32.cc
index
bcb90ca802677f0420aa5f0956f7292a5daa09fe..f9d1fc0d258febca439f4d4c953f903e89a32775
100644
--- a/src/ia32/lithium-codegen-ia32.cc
+++ b/src/ia32/lithium-codegen-ia32.cc
@@ -5780,7 +5780,11 @@ void LCodeGen::DoAllocate(LAllocate* instr) {
if (instr->size()->IsConstantOperand()) {
int32_t size = ToInteger32(LConstantOperand::cast(instr->size()));
- __ Allocate(size, result, temp, no_reg, deferred->entry(), flags);
+ if (size <= Page::kMaxRegularHeapObjectSize) {
+ __ Allocate(size, result, temp, no_reg, deferred->entry(), flags);
+ } else {
+ __ jmp(deferred->entry());
+ }
} else {
Register size = ToRegister(instr->size());
__ Allocate(size, result, temp, no_reg, deferred->entry(), flags);
Index: src/mips/lithium-codegen-mips.cc
diff --git a/src/mips/lithium-codegen-mips.cc
b/src/mips/lithium-codegen-mips.cc
index
0f7614b68e38ca817f2097c72f317a6ca91d2013..d34344c83f371de77c18e0ccfa7cae81f5f3e19f
100644
--- a/src/mips/lithium-codegen-mips.cc
+++ b/src/mips/lithium-codegen-mips.cc
@@ -5196,7 +5196,11 @@ void LCodeGen::DoAllocate(LAllocate* instr) {
}
if (instr->size()->IsConstantOperand()) {
int32_t size = ToInteger32(LConstantOperand::cast(instr->size()));
- __ Allocate(size, result, scratch, scratch2, deferred->entry(), flags);
+ if (size <= Page::kMaxRegularHeapObjectSize) {
+ __ Allocate(size, result, scratch, scratch2, deferred->entry(),
flags);
+ } else {
+ __ jmp(deferred->entry());
+ }
} else {
Register size = ToRegister(instr->size());
__ Allocate(size,
Index: src/property-details.h
diff --git a/src/property-details.h b/src/property-details.h
index
5f0920b6705d5b19e39966bf2ed7c51af60cb089..b8baff2c26de1e96f6287cc5e4bd5bd1867ef9c9
100644
--- a/src/property-details.h
+++ b/src/property-details.h
@@ -138,7 +138,7 @@ class Representation {
ASSERT(kind_ != kExternal);
ASSERT(other.kind_ != kExternal);
- if (IsHeapObject()) return other.IsDouble() || other.IsNone();
+ if (IsHeapObject()) return other.IsNone();
if (kind_ == kUInteger8 && other.kind_ == kInteger8) return false;
if (kind_ == kUInteger16 && other.kind_ == kInteger16) return false;
return kind_ > other.kind_;
Index: src/version.cc
diff --git a/src/version.cc b/src/version.cc
index
488faea92adf42ec1636e3b4867023813827c072..c13e570350c92f5cf72aa08617af6d4b1693dae8
100644
--- a/src/version.cc
+++ b/src/version.cc
@@ -35,7 +35,7 @@
#define MAJOR_VERSION 3
#define MINOR_VERSION 24
#define BUILD_NUMBER 35
-#define PATCH_LEVEL 5
+#define PATCH_LEVEL 6
// Use 1 for candidates and 0 otherwise.
// (Boolean macro values are not supported by all preprocessors.)
#define IS_CANDIDATE_VERSION 0
Index: src/x64/lithium-codegen-x64.cc
diff --git a/src/x64/lithium-codegen-x64.cc b/src/x64/lithium-codegen-x64.cc
index
ff9caa527c5649ba12481ad1bc132a342467376e..1e612db64163b539e964b37c53ac34f55480d9a3
100644
--- a/src/x64/lithium-codegen-x64.cc
+++ b/src/x64/lithium-codegen-x64.cc
@@ -5051,7 +5051,11 @@ void LCodeGen::DoAllocate(LAllocate* instr) {
if (instr->size()->IsConstantOperand()) {
int32_t size = ToInteger32(LConstantOperand::cast(instr->size()));
- __ Allocate(size, result, temp, no_reg, deferred->entry(), flags);
+ if (size <= Page::kMaxRegularHeapObjectSize) {
+ __ Allocate(size, result, temp, no_reg, deferred->entry(), flags);
+ } else {
+ __ jmp(deferred->entry());
+ }
} else {
Register size = ToRegister(instr->size());
__ Allocate(size, result, temp, no_reg, deferred->entry(), flags);
Index: test/mjsunit/regress/regress-347909.js
diff --git a/test/mjsunit/regress/regress-crbug-345715.js
b/test/mjsunit/regress/regress-347909.js
similarity index 52%
copy from test/mjsunit/regress/regress-crbug-345715.js
copy to test/mjsunit/regress/regress-347909.js
index
a3753417dfb6f8440ec36f883dc6ac1be4a6c8ce..90a8e6a759eab76afef1dc968c814bd9d324b147
100644
--- a/test/mjsunit/regress/regress-crbug-345715.js
+++ b/test/mjsunit/regress/regress-347909.js
@@ -4,23 +4,16 @@
// Flags: --allow-natives-syntax
-a = {y:1.5};
+var a = {y:1.5};
a.y = 0;
-b = a.y;
-c = {y:{}};
-
+var b = a.y;
+a.y = {};
+var d = 1;
function f() {
- return 1;
-}
-
-function g() {
- var e = {y: b};
- var d = {x:f()};
- var d = {x:f()};
- return [e, d];
+ d = 0;
+ return {y: b};
}
-
-g();
-g();
-%OptimizeFunctionOnNextCall(g);
-assertEquals(1, g()[1].x);
+f();
+f();
+%OptimizeFunctionOnNextCall(f);
+f();
--
--
v8-dev mailing list
[email protected]
http://groups.google.com/group/v8-dev
---
You received this message because you are subscribed to the Google Groups "v8-dev" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
For more options, visit https://groups.google.com/groups/opt_out.
