Commit 444f83d9 authored by Benedikt Meurer's avatar Benedikt Meurer Committed by Commit Bot

[turbofan] Fix missing `break` in EscapeAnalysis.

In the case of LoadElement in EscapeAnalysis we accidentally always set
the object as escaping, even in the case where the index was a constant
(or had a constant type).

This forced us to always allocate array backing stores even in the
trivial cases like swapping, i.e.

```js
function foo(a, b) {
  [a, b] = [b, a];
  return a - b;
}
```

Now with this change we do proper scalar replacement again, even for the
array backing stores.

Bug: v8:9183
Change-Id: I3b2dcade23e47df032087778aca1292c8b0d69d4
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1612907Reviewed-by: 's avatarJaroslav Sevcik <jarin@chromium.org>
Commit-Queue: Benedikt Meurer <bmeurer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#61521}
parent 9991b408
......@@ -622,6 +622,7 @@ void ReduceNode(const Operator* op, EscapeAnalysisTracker::Scope* current,
OffsetOfElementsAccess(op, index).To(&offset) &&
vobject->FieldAt(offset).To(&var) && current->Get(var).To(&value)) {
current->SetReplacement(value);
break;
} else if (vobject && !vobject->HasEscaped()) {
// Compute the known length (aka the number of elements) of {object}
// based on the virtual object information.
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment