Commit 1103d4cf authored by Sigurd Schneider's avatar Sigurd Schneider Committed by Commit Bot

[turbofan] Allow deopt in Array.push to disallow speculation

This CL passes feedback from the element kind deopt points
in Array.push to the deoptimizer. If the deopt points are
triggered, further speculation on Array.push is disallowed.

Bug: v8:7127, v8:7204
Change-Id: Ie91dee598bd8b8797110c8f468406327226893a4
Reviewed-on: https://chromium-review.googlesource.com/831523
Commit-Queue: Sigurd Schneider <sigurds@chromium.org>
Reviewed-by: 's avatarBenedikt Meurer <bmeurer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#50171}
parent 06309e15
......@@ -1044,12 +1044,11 @@ Reduction JSBuiltinReducer::ReduceArrayPush(Node* node) {
// Array.prototype.push inlining for this function.
for (auto& value : values) {
if (IsSmiElementsKind(receiver_map->elements_kind())) {
value = effect = graph()->NewNode(
simplified()->CheckSmi(VectorSlotPair()), value, effect, control);
value = effect = graph()->NewNode(simplified()->CheckSmi(p.feedback()),
value, effect, control);
} else if (IsDoubleElementsKind(receiver_map->elements_kind())) {
value = effect =
graph()->NewNode(simplified()->CheckNumber(VectorSlotPair()), value,
effect, control);
value = effect = graph()->NewNode(
simplified()->CheckNumber(p.feedback()), value, effect, control);
// Make sure we do not store signaling NaNs into double arrays.
value = graph()->NewNode(simplified()->NumberSilenceNaN(), value);
}
......
......@@ -16,6 +16,29 @@
assertOptimized(foo);
})();
(function testElementTypeCheckSmi() {
function foo(a) { a.push('a'); }
foo([1]);
foo([1]);
%OptimizeFunctionOnNextCall(foo);
foo([1]);
%OptimizeFunctionOnNextCall(foo);
foo([1]);
assertOptimized(foo);
})();
(function testElementTypeCheckDouble() {
function foo(a) { a.push('a'); }
foo([0.3413312]);
foo([0.3413312]);
%OptimizeFunctionOnNextCall(foo);
foo([0.3413312]);
%OptimizeFunctionOnNextCall(foo);
foo([0.3413312]);
assertOptimized(foo);
})();
(function test() {
function bar(a) { a.x = 2 };
%NeverOptimizeFunction(bar);
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment