Reviewers: Jakob, Benedikt Meurer,
Message:
PTAL
Description:
Propagate updated offsets in BoundsCheckBbData.
BUG=350863
TEST=mjsunit/regress/regress-350863.js
Please review this at https://codereview.chromium.org/197823009/
SVN Base: https://v8.googlecode.com/svn/branches/bleeding_edge
Affected files (+39, -12 lines):
M src/hydrogen-bce.cc
A + test/mjsunit/regress/regress-350863.js
Index: src/hydrogen-bce.cc
diff --git a/src/hydrogen-bce.cc b/src/hydrogen-bce.cc
index
e1a28471273f75274a85056b2c78ff06dba8cf10..cef1e0fca0b5974d9848ae64d8faaf111c31c885
100644
--- a/src/hydrogen-bce.cc
+++ b/src/hydrogen-bce.cc
@@ -132,6 +132,24 @@ class BoundsCheckBbData: public ZoneObject {
bool HasSingleCheck() { return lower_check_ == upper_check_; }
+ void UpdateUpperOffsets(HBoundsCheck* check, int32_t offset) {
+ BoundsCheckBbData* data = FatherInDominatorTree();
+ while (data != NULL && data->UpperCheck() == check) {
+ ASSERT(data->upper_offset_ <= offset);
+ data->upper_offset_ = offset;
+ data = data->FatherInDominatorTree();
+ }
+ }
+
+ void UpdateLowerOffsets(HBoundsCheck* check, int32_t offset) {
+ BoundsCheckBbData* data = FatherInDominatorTree();
+ while (data != NULL && data->LowerCheck() == check) {
+ ASSERT(data->lower_offset_ > offset);
+ data->lower_offset_ = offset;
+ data = data->FatherInDominatorTree();
+ }
+ }
+
// The goal of this method is to modify either upper_offset_ or
// lower_offset_ so that also new_offset is covered (the covered
// range grows).
@@ -156,6 +174,7 @@ class BoundsCheckBbData: public ZoneObject {
upper_check_ = new_check;
} else {
TightenCheck(upper_check_, new_check);
+ UpdateUpperOffsets(upper_check_, upper_offset_);
}
} else if (new_offset < lower_offset_) {
lower_offset_ = new_offset;
@@ -164,6 +183,7 @@ class BoundsCheckBbData: public ZoneObject {
lower_check_ = new_check;
} else {
TightenCheck(lower_check_, new_check);
+ UpdateLowerOffsets(upper_check_, upper_offset_);
}
} else {
// Should never have called CoverCheck() in this case.
Index: test/mjsunit/regress/regress-350863.js
diff --git a/test/mjsunit/regress/regress-346343.js
b/test/mjsunit/regress/regress-350863.js
similarity index 79%
copy from test/mjsunit/regress/regress-346343.js
copy to test/mjsunit/regress/regress-350863.js
index
e4c10663138db599a682880df98f3310e0754b63..c127f95cf1231e30c4de3d976e49dacfaf5818ba
100644
--- a/test/mjsunit/regress/regress-346343.js
+++ b/test/mjsunit/regress/regress-350863.js
@@ -24,19 +24,26 @@
// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
-
+//
// Flags: --allow-natives-syntax
-function f(o) {
- for (var i = 1; i < 2; ++i) {
- var y = o.y;
+var __v_6 = /abc/;
+__v_7 = new Int32Array(1024);
+
+function __f_8(__v_7, base, condition) {
+ __v_7 = __v_6;
+ __v_7[base + 3] = 0;
+ __v_7[base + 4] = 0;
+ if (condition) {
+ __v_7[base + 0] = 0;
+ __v_7[base + 5] = 0;
+ } else {
+ __v_7[base + 0] = 0;
+ __v_7[base + 18] = 0;
}
}
-f({y:1.1});
-f({y:1.1});
-
-function g(x) { f({z:x}); }
-g(1);
-g(2);
-%OptimizeFunctionOnNextCall(g);
-g(1);
+__f_8(__v_7, 1, true);
+__f_8(__v_7, 1, false);
+%OptimizeFunctionOnNextCall(__f_8);
+__v_8 = new Int32Array(128);
+__f_8(__v_8, 5, false);
--
--
v8-dev mailing list
[email protected]
http://groups.google.com/group/v8-dev
---
You received this message because you are subscribed to the Google Groups "v8-dev" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
For more options, visit https://groups.google.com/d/optout.
