Commit 164f92d2 authored by mvstanton's avatar mvstanton Committed by Commit bot

Crankshaft: consolidated element loads always deopted on seeing the hole

Update the consolidated load case to carefully chose the load mode
based on the consolidated elements kind.

BUG=v8:4380
LOG=N

Review URL: https://codereview.chromium.org/1329793003

Cr-Commit-Position: refs/heads/master@{#30659}
parent 44b9f1e7
......@@ -7433,11 +7433,46 @@ HInstruction* HOptimizedGraphBuilder::TryBuildConsolidatedElementLoad(
ElementsKind consolidated_elements_kind = has_seen_holey_elements
? GetHoleyElementsKind(most_general_consolidated_map->elements_kind())
: most_general_consolidated_map->elements_kind();
LoadKeyedHoleMode load_mode = NEVER_RETURN_HOLE;
if (has_seen_holey_elements) {
if (!isolate()->IsFastArrayConstructorPrototypeChainIntact()) {
return NULL;
}
// Make sure that all of the maps we are handling have the initial array
// prototype.
for (int i = 0; i < maps->length(); ++i) {
Handle<Map> map = maps->at(i);
if (map->prototype() != *isolate()->initial_array_prototype()) {
// We can't guarantee that loading the hole is safe. The prototype may
// have an element at this position.
return NULL;
}
}
Handle<Map> holey_map =
handle(isolate()->get_initial_js_array_map(consolidated_elements_kind));
load_mode = BuildKeyedHoleMode(holey_map);
if (load_mode == NEVER_RETURN_HOLE) {
return NULL;
}
for (int i = 0; i < maps->length(); ++i) {
Handle<Map> map = maps->at(i);
// The prototype check was already done for the holey map in
// BuildKeyedHoleMode.
if (!map.is_identical_to(holey_map)) {
Handle<JSObject> prototype(JSObject::cast(map->prototype()), isolate());
Handle<JSObject> object_prototype =
isolate()->initial_object_prototype();
BuildCheckPrototypeMaps(prototype, object_prototype);
}
}
}
HInstruction* instr = BuildUncheckedMonomorphicElementAccess(
checked_object, key, val,
most_general_consolidated_map->instance_type() == JS_ARRAY_TYPE,
consolidated_elements_kind,
LOAD, NEVER_RETURN_HOLE, STANDARD_STORE);
consolidated_elements_kind, LOAD, load_mode, STANDARD_STORE);
return instr;
}
......
// Copyright 2015 the V8 project authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
// Flags: --allow-natives-syntax
function bar(a) {
var x = a[0];
return x == undefined;
}
// Make the keyed load be polymorphic on holey smi and holey fast.
bar([, 2, 3]);
bar([, 'two', 'three']);
bar([, 2, 3]);
%OptimizeFunctionOnNextCall(bar);
bar([, 2, 3]);
// Verify that loading the hole doesn't cause deoptimization.
assertOptimized(bar);
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment