Commit 08506763 authored by Nico Hartmann's avatar Nico Hartmann Committed by V8 LUCI CQ

[turbofan] Fix incorrect typing of NumberAdd

Bug: v8:12633
Change-Id: I4bb98b9f93f7c4a13f7374c732f47aaffedd4a14
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3468897
Auto-Submit: Nico Hartmann <nicohartmann@chromium.org>
Reviewed-by: 's avatarTobias Tebbi <tebbi@chromium.org>
Commit-Queue: Tobias Tebbi <tebbi@chromium.org>
Cr-Commit-Position: refs/heads/main@{#79129}
parent b4a62038
......@@ -6,6 +6,7 @@
#include "src/compiler/all-nodes.h"
#include "src/compiler/node-matchers.h"
#include "src/compiler/operation-typer.h"
#include "src/compiler/simplified-operator.h"
#include "src/compiler/type-cache.h"
#include "src/execution/frame-constants.h"
......@@ -24,10 +25,11 @@ namespace compiler {
#endif // DEBUG
EscapeAnalysisReducer::EscapeAnalysisReducer(
Editor* editor, JSGraph* jsgraph, EscapeAnalysisResult analysis_result,
Zone* zone)
Editor* editor, JSGraph* jsgraph, JSHeapBroker* broker,
EscapeAnalysisResult analysis_result, Zone* zone)
: AdvancedReducer(editor),
jsgraph_(jsgraph),
broker_(broker),
analysis_result_(analysis_result),
object_id_cache_(zone),
node_cache_(jsgraph->graph(), zone),
......@@ -221,6 +223,7 @@ void EscapeAnalysisReducer::VerifyReplacement() const {
}
void EscapeAnalysisReducer::Finalize() {
OperationTyper op_typer(broker_, jsgraph()->graph()->zone());
for (Node* node : arguments_elements_) {
const NewArgumentsElementsParameters& params =
NewArgumentsElementsParametersOf(node->op());
......@@ -318,17 +321,21 @@ void EscapeAnalysisReducer::Finalize() {
Node* offset = jsgraph()->graph()->NewNode(
jsgraph()->simplified()->NumberAdd(), index,
offset_to_first_elem);
Type offset_type = op_typer.NumberAdd(
NodeProperties::GetType(index),
NodeProperties::GetType(offset_to_first_elem));
NodeProperties::SetType(offset, offset_type);
if (type == CreateArgumentsType::kRestParameter) {
// In the case of rest parameters we should skip the formal
// parameters.
NodeProperties::SetType(offset,
TypeCache::Get()->kArgumentsLengthType);
offset = jsgraph()->graph()->NewNode(
jsgraph()->simplified()->NumberAdd(), offset,
formal_parameter_count);
NodeProperties::SetType(
offset, op_typer.NumberAdd(
offset_type,
NodeProperties::GetType(formal_parameter_count)));
}
NodeProperties::SetType(offset,
TypeCache::Get()->kArgumentsLengthType);
Node* frame = jsgraph()->graph()->NewNode(
jsgraph()->machine()->LoadFramePointer());
NodeProperties::SetType(frame, Type::ExternalPointer());
......
......@@ -83,7 +83,7 @@ class NodeHashCache {
class V8_EXPORT_PRIVATE EscapeAnalysisReducer final
: public NON_EXPORTED_BASE(AdvancedReducer) {
public:
EscapeAnalysisReducer(Editor* editor, JSGraph* jsgraph,
EscapeAnalysisReducer(Editor* editor, JSGraph* jsgraph, JSHeapBroker* broker,
EscapeAnalysisResult analysis_result, Zone* zone);
EscapeAnalysisReducer(const EscapeAnalysisReducer&) = delete;
EscapeAnalysisReducer& operator=(const EscapeAnalysisReducer&) = delete;
......@@ -108,6 +108,7 @@ class V8_EXPORT_PRIVATE EscapeAnalysisReducer final
Zone* zone() const { return zone_; }
JSGraph* const jsgraph_;
JSHeapBroker* const broker_;
EscapeAnalysisResult analysis_result_;
ZoneVector<Node*> object_id_cache_;
NodeHashCache node_cache_;
......
......@@ -1544,9 +1544,9 @@ struct EscapeAnalysisPhase {
GraphReducer reducer(temp_zone, data->graph(),
&data->info()->tick_counter(), data->broker(),
data->jsgraph()->Dead(), data->observe_node_manager());
EscapeAnalysisReducer escape_reducer(&reducer, data->jsgraph(),
escape_analysis.analysis_result(),
temp_zone);
EscapeAnalysisReducer escape_reducer(
&reducer, data->jsgraph(), data->broker(),
escape_analysis.analysis_result(), temp_zone);
AddReducer(data, &reducer, &escape_reducer);
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment