Skip to content
This repository has been archived by the owner on Mar 25, 2018. It is now read-only.

Commit

Permalink
Version 5.4.500.1 (cherry-pick)
Browse files Browse the repository at this point in the history
Merged 6646d73

[turbofan] Use ObjectIsReceiver directly for inlining.

BUG=chromium:640369
LOG=N
R=mstarzinger@chromium.org
TBR=mstarzinger@chromium.org

Review URL: https://codereview.chromium.org/2272393002 .

Cr-Commit-Position: refs/heads/5.4.500@{#2}
Cr-Branched-From: ad07b49-refs/heads/master@{#38841}
  • Loading branch information
natorion committed Aug 25, 2016
1 parent 4fb8ad0 commit 5ce2827
Show file tree
Hide file tree
Showing 4 changed files with 25 additions and 9 deletions.
2 changes: 1 addition & 1 deletion include/v8-version.h
Original file line number Diff line number Diff line change
Expand Up @@ -11,7 +11,7 @@
#define V8_MAJOR_VERSION 5
#define V8_MINOR_VERSION 4
#define V8_BUILD_NUMBER 500
#define V8_PATCH_LEVEL 0
#define V8_PATCH_LEVEL 1

// Use 1 for candidates and 0 otherwise.
// (Boolean macro values are not supported by all preprocessors.)
Expand Down
16 changes: 8 additions & 8 deletions src/compiler/js-inlining.cc
Original file line number Diff line number Diff line change
Expand Up @@ -16,6 +16,7 @@
#include "src/compiler/node-matchers.h"
#include "src/compiler/node-properties.h"
#include "src/compiler/operator-properties.h"
#include "src/compiler/simplified-operator.h"
#include "src/compiler/type-hint-analyzer.h"
#include "src/isolate-inl.h"
#include "src/parsing/parse-info.h"
Expand Down Expand Up @@ -435,20 +436,15 @@ Reduction JSInliner::ReduceJSCall(Node* node, Handle<JSFunction> function) {
NodeProperties::ReplaceEffectInput(node, create);
// Insert a check of the return value to determine whether the return
// value or the implicit receiver should be selected as a result of the
// call. The check is wired into the successful control completion.
Node* success = graph()->NewNode(common()->IfSuccess(), node);
Node* check = graph()->NewNode(
javascript()->CallRuntime(Runtime::kInlineIsJSReceiver, 1), node,
context, node, success);
// call.
Node* check = graph()->NewNode(simplified()->ObjectIsReceiver(), node);
Node* select =
graph()->NewNode(common()->Select(MachineRepresentation::kTagged),
check, node, create);
NodeProperties::ReplaceUses(node, select, check, check, node);
NodeProperties::ReplaceUses(node, select, node, node, node);
// Fix-up inputs that have been mangled by the {ReplaceUses} call above.
NodeProperties::ReplaceValueInput(select, node, 1); // Fix-up input.
NodeProperties::ReplaceValueInput(check, node, 0); // Fix-up input.
NodeProperties::ReplaceEffectInput(check, node); // Fix-up input.
NodeProperties::ReplaceControlInput(success, node); // Fix-up input.
receiver = create; // The implicit receiver.
}

Expand Down Expand Up @@ -527,6 +523,10 @@ JSOperatorBuilder* JSInliner::javascript() const {

CommonOperatorBuilder* JSInliner::common() const { return jsgraph()->common(); }

SimplifiedOperatorBuilder* JSInliner::simplified() const {
return jsgraph()->simplified();
}

} // namespace compiler
} // namespace internal
} // namespace v8
1 change: 1 addition & 0 deletions src/compiler/js-inlining.h
Original file line number Diff line number Diff line change
Expand Up @@ -38,6 +38,7 @@ class JSInliner final : public AdvancedReducer {
private:
CommonOperatorBuilder* common() const;
JSOperatorBuilder* javascript() const;
SimplifiedOperatorBuilder* simplified() const;
Graph* graph() const;
JSGraph* jsgraph() const { return jsgraph_; }

Expand Down
15 changes: 15 additions & 0 deletions test/mjsunit/regress/regress-crbug-640369.js
Original file line number Diff line number Diff line change
@@ -0,0 +1,15 @@
// Copyright 2014 the V8 project authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.

// Flags: --allow-natives-syntax

function A() {
this.x = 0;
for (var i = 0; i < max; ) {}
}
function foo() {
for (var i = 0; i < 1; i = 2) %OptimizeOsr();
return new A();
}
try { foo(); } catch (e) { }

0 comments on commit 5ce2827

Please sign in to comment.