Reviewers: Michael Achenbach,
Description:
Merged r18548 into 3.23 branch.
Fix of Hydrogen environment building for function "apply" calls.
[email protected]
BUG=v8:3084
LOG=N
Please review this at https://codereview.chromium.org/201563004/
SVN Base: https://v8.googlecode.com/svn/branches/3.23
Affected files (+46, -23 lines):
M src/hydrogen.cc
M src/version.cc
A + test/mjsunit/arguments-apply-deopt.js
Index: src/hydrogen.cc
diff --git a/src/hydrogen.cc b/src/hydrogen.cc
index
cdf69e7c72c672490e853d537951203e64353a4c..c40d2e77ffcf504195330a4315941cff4a16f4c3
100644
--- a/src/hydrogen.cc
+++ b/src/hydrogen.cc
@@ -7553,11 +7553,12 @@ bool HOptimizedGraphBuilder::TryCallApply(Call*
expr) {
HValue* function = Top();
AddCheckConstantFunction(expr->holder(), function, function_map);
- Drop(1);
CHECK_ALIVE_OR_RETURN(VisitForValue(args->at(0)), true);
HValue* receiver = Pop();
+ Drop(1); // Pop the function.
+
if (function_state()->outer() == NULL) {
HInstruction* elements = Add<HArgumentsElements>(false);
HInstruction* length = Add<HArgumentsLength>(elements);
Index: src/version.cc
diff --git a/src/version.cc b/src/version.cc
index
ac4596a4758c7830d1b44f6fc5070245e5a45f36..b6cf931567b2993645df528e970cb9b52d3fabf4
100644
--- a/src/version.cc
+++ b/src/version.cc
@@ -35,7 +35,7 @@
#define MAJOR_VERSION 3
#define MINOR_VERSION 23
#define BUILD_NUMBER 17
-#define PATCH_LEVEL 25
+#define PATCH_LEVEL 26
// Use 1 for candidates and 0 otherwise.
// (Boolean macro values are not supported by all preprocessors.)
#define IS_CANDIDATE_VERSION 0
Index: test/mjsunit/arguments-apply-deopt.js
diff --git a/test/mjsunit/regress/regress-crbug-150545.js
b/test/mjsunit/arguments-apply-deopt.js
similarity index 66%
copy from test/mjsunit/regress/regress-crbug-150545.js
copy to test/mjsunit/arguments-apply-deopt.js
index
8238d2fa0d36ffd40be60628d333f5dcb1f0ba51..b7251af5aa1567087d7bb9d333dc1fed2f3ecb89
100644
--- a/test/mjsunit/regress/regress-crbug-150545.js
+++ b/test/mjsunit/arguments-apply-deopt.js
@@ -27,29 +27,51 @@
// Flags: --allow-natives-syntax
-// Test that we do not generate OSR entry points that have an arguments
-// stack height different from zero. The OSR machinery cannot generate
-// frames for that.
-
-(function() {
- "use strict";
-
- var instantReturn = false;
- function inner() {
- if (instantReturn) return;
- assertSame(3, arguments.length);
- assertSame(1, arguments[0]);
- assertSame(2, arguments[1]);
- assertSame(3, arguments[2]);
+(function ApplyArgumentsDeoptInReceiverMapCheck() {
+ function invoker(h, r) {
+ return function XXXXX() {
+ var res = h.apply({ fffffff : r(this) }, arguments);
+ return res;
+ };
}
- function outer() {
- inner(1,2,3);
- // Trigger OSR, if optimization is not disabled.
- if (%GetOptimizationStatus(outer) != 4) {
- while (%GetOptimizationCount(outer) == 0) {}
- }
+ var y = invoker(m, selfOf);
+
+ function selfOf(c) {
+ var sssss = c.self_;
+ return sssss;
+ }
+
+ function m() {
+ return this.fffffff;
}
- outer();
+ y.apply({ self_ : 3 });
+ y.apply({ self_ : 3 });
+ y.apply({ self_ : 3 });
+
+ %OptimizeFunctionOnNextCall(y);
+
+ assertEquals(y.apply({ self_ : 3, uuu : 4 }), 3);
+})();
+
+(function ApplyArgumentsDeoptInReceiverExplicit() {
+ function f() { return this + 21; }
+
+ function deopt() {
+ %DeoptimizeFunction(XXXXX);
+ return 21;
+ }
+
+ function XXXXX() {
+ return f.apply(deopt(), arguments);
+ };
+
+ XXXXX();
+ XXXXX();
+ XXXXX();
+
+ %OptimizeFunctionOnNextCall(XXXXX);
+
+ assertEquals(42, XXXXX());
})();
--
--
v8-dev mailing list
[email protected]
http://groups.google.com/group/v8-dev
---
You received this message because you are subscribed to the Google Groups "v8-dev" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
For more options, visit https://groups.google.com/d/optout.
