Commit 434b456b authored by verwaest's avatar verwaest Committed by Commit bot

Fix indirect push

BUG=chromium:388665
LOG=n

Review URL: https://codereview.chromium.org/1087463003

Cr-Commit-Position: refs/heads/master@{#27795}
parent c7f40ce7
...@@ -2388,6 +2388,8 @@ HInstruction* HGraphBuilder::BuildUncheckedMonomorphicElementAccess( ...@@ -2388,6 +2388,8 @@ HInstruction* HGraphBuilder::BuildUncheckedMonomorphicElementAccess(
PropertyAccessType access_type, PropertyAccessType access_type,
LoadKeyedHoleMode load_mode, LoadKeyedHoleMode load_mode,
KeyedAccessStoreMode store_mode) { KeyedAccessStoreMode store_mode) {
DCHECK(top_info()->IsStub() || checked_object->IsCompareMap() ||
checked_object->IsCheckMaps());
DCHECK((!IsExternalArrayElementsKind(elements_kind) && DCHECK((!IsExternalArrayElementsKind(elements_kind) &&
!IsFixedTypedArrayElementsKind(elements_kind)) || !IsFixedTypedArrayElementsKind(elements_kind)) ||
!is_js_array); !is_js_array);
...@@ -8454,11 +8456,10 @@ bool HOptimizedGraphBuilder::TryInlineBuiltinMethodCall( ...@@ -8454,11 +8456,10 @@ bool HOptimizedGraphBuilder::TryInlineBuiltinMethodCall(
new_size = AddUncasted<HAdd>(length, graph()->GetConstant1()); new_size = AddUncasted<HAdd>(length, graph()->GetConstant1());
bool is_array = receiver_map->instance_type() == JS_ARRAY_TYPE; bool is_array = receiver_map->instance_type() == JS_ARRAY_TYPE;
BuildUncheckedMonomorphicElementAccess(array, length, HValue* checked_array = Add<HCheckMaps>(array, receiver_map);
value_to_push, is_array, BuildUncheckedMonomorphicElementAccess(
elements_kind, STORE, checked_array, length, value_to_push, is_array, elements_kind,
NEVER_RETURN_HOLE, STORE, NEVER_RETURN_HOLE, STORE_AND_GROW_NO_TRANSITION);
STORE_AND_GROW_NO_TRANSITION);
if (!ast_context()->IsEffect()) Push(new_size); if (!ast_context()->IsEffect()) Push(new_size);
Add<HSimulate>(expr->id(), REMOVABLE_SIMULATE); Add<HSimulate>(expr->id(), REMOVABLE_SIMULATE);
...@@ -8825,18 +8826,9 @@ void HOptimizedGraphBuilder::HandleIndirectCall(Call* expr, HValue* function, ...@@ -8825,18 +8826,9 @@ void HOptimizedGraphBuilder::HandleIndirectCall(Call* expr, HValue* function,
int args_count_no_receiver = arguments_count - 1; int args_count_no_receiver = arguments_count - 1;
if (function->IsConstant() && if (function->IsConstant() &&
HConstant::cast(function)->handle(isolate())->IsJSFunction()) { HConstant::cast(function)->handle(isolate())->IsJSFunction()) {
HValue* receiver = environment()->ExpressionStackAt(args_count_no_receiver);
Handle<Map> receiver_map;
if (receiver->IsConstant() &&
HConstant::cast(receiver)->handle(isolate())->IsHeapObject()) {
receiver_map =
handle(Handle<HeapObject>::cast(
HConstant::cast(receiver)->handle(isolate()))->map());
}
known_function = known_function =
Handle<JSFunction>::cast(HConstant::cast(function)->handle(isolate())); Handle<JSFunction>::cast(HConstant::cast(function)->handle(isolate()));
if (TryInlineBuiltinMethodCall(expr, known_function, receiver_map, if (TryInlineBuiltinMethodCall(expr, known_function, Handle<Map>(),
args_count_no_receiver)) { args_count_no_receiver)) {
if (FLAG_trace_inlining) { if (FLAG_trace_inlining) {
PrintF("Inlining builtin "); PrintF("Inlining builtin ");
......
// Copyright 2015 the V8 project authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
// Flags: --allow-natives-syntax
var a = [1.5];
function p() {
Array.prototype.push.call(a, 1.7);
}
p();
p();
p();
%OptimizeFunctionOnNextCall(p);
p();
a.push({});
p();
assertEquals(1.7, a[a.length - 1]);
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment