• Tobias Tebbi's avatar
    [turbofan] fix escape analysis divergence on Air benchmark · d871c5ba
    Tobias Tebbi authored
    When a virtual object passes by a store node that updates a field to the existing value, then the object and its state were not copied, which lead to the original object being passed on. 
    If then later the store actually modifies and copies the virtual object, this new copy is not passed down the effect chain, so subsequent nodes still refer to the original virtual object and try to update it once new information flows in.
    This conflicts with updates on the node that originally created the virtual object, leading to divergence.
    
    Bug: v8:6345
    Change-Id: Iab1ce98a60b48478b343eae765c80bdfcb8ba390
    Reviewed-on: https://chromium-review.googlesource.com/496267
    Commit-Queue: Tobias Tebbi <tebbi@chromium.org>
    Reviewed-by: 's avatarJaroslav Sevcik <jarin@chromium.org>
    Cr-Commit-Position: refs/heads/master@{#45120}
    d871c5ba
Name
Last commit
Last update
..
accessor-exceptions1.js Loading commit data...
accessor-exceptions2.js Loading commit data...
alloc-number-debug.js Loading commit data...
alloc-number.js Loading commit data...
alloc-object-huge.js Loading commit data...
alloc-object.js Loading commit data...
array-access.js Loading commit data...
array-constructor.js Loading commit data...
array-length.js Loading commit data...
assignment-deopt.js Loading commit data...
assignment.js Loading commit data...
binary-ops.js Loading commit data...
boolean-protototype.js Loading commit data...
call-keyed.js Loading commit data...
capture-context.js Loading commit data...
compare-map-elim.js Loading commit data...
compare-map-elim2.js Loading commit data...
compare-objeq-elim.js Loading commit data...
compare.js Loading commit data...
complex-for-in.js Loading commit data...
concurrent-invalidate-transition-map.js Loading commit data...
concurrent-proto-change.js Loading commit data...
control-flow-0.js Loading commit data...
control-flow-1.js Loading commit data...
control-flow-2.js Loading commit data...
count-deopt.js Loading commit data...
countoperation.js Loading commit data...
dead-code.js Loading commit data...
dead-code2.js Loading commit data...
dead-code3.js Loading commit data...
dead-code4.js Loading commit data...
dead-code5.js Loading commit data...
dead-code6.js Loading commit data...
dead-loops-neg.js Loading commit data...
dead-loops.js Loading commit data...
dead-string-add-warm.js Loading commit data...
dead-string-add.js Loading commit data...
dead-string-char-code-at.js Loading commit data...
dead-string-char-code-at2.js Loading commit data...
delete.js Loading commit data...
deopt-accessors1.js Loading commit data...
deopt-accessors2.js Loading commit data...
deopt-accessors3.js Loading commit data...
deopt-accessors4.js Loading commit data...
deopt-accessors5.js Loading commit data...
deopt-accessors6.js Loading commit data...
deopt-accessors7.js Loading commit data...
deopt-args.js Loading commit data...
deopt-bool.js Loading commit data...
deopt-bool2.js Loading commit data...
deopt-during-eval-lookup.js Loading commit data...
deopt-inlined-from-call.js Loading commit data...
deopt-inlined-smi.js Loading commit data...
deopt-materialize-accumulator.js Loading commit data...
deopt-numberoroddball-binop.js Loading commit data...
deopt-string-outofbounds.js Loading commit data...
deopt-tonumber-binop.js Loading commit data...
deopt-tonumber-compare.js Loading commit data...
deopt-tonumber-shift.js Loading commit data...
division-by-constant.js Loading commit data...
dont-constant-fold-deopting-checks.js Loading commit data...
double-array-to-global.js Loading commit data...
eager-deopt-simple.js Loading commit data...
escape-analysis-1.js Loading commit data...
escape-analysis-10.js Loading commit data...
escape-analysis-11.js Loading commit data...
escape-analysis-12.js Loading commit data...
escape-analysis-13.js Loading commit data...
escape-analysis-15.js Loading commit data...
escape-analysis-16.js Loading commit data...
escape-analysis-2.js Loading commit data...
escape-analysis-3.js Loading commit data...
escape-analysis-4.js Loading commit data...
escape-analysis-5.js Loading commit data...
escape-analysis-6.js Loading commit data...
escape-analysis-7.js Loading commit data...
escape-analysis-8.js Loading commit data...
escape-analysis-9.js Loading commit data...
escape-analysis-arguments.js Loading commit data...
escape-analysis-deopt-1.js Loading commit data...
escape-analysis-deopt-2.js Loading commit data...
escape-analysis-deopt-3.js Loading commit data...
escape-analysis-deopt-4.js Loading commit data...
escape-analysis-deopt-5.js Loading commit data...
escape-analysis-deopt-6.js Loading commit data...
escape-analysis-framestate-use-at-branchpoint.js Loading commit data...
escape-analysis-materialize.js Loading commit data...
escape-analysis-replacement.js Loading commit data...
escape-analysis-representation.js Loading commit data...
escape-analysis.js Loading commit data...
eval-introduced-closure.js Loading commit data...
expression-trees.js Loading commit data...
feedback-after-throw.js Loading commit data...
for-stmt.js Loading commit data...
function-call.js Loading commit data...
generic-add.js Loading commit data...
global-accessors.js Loading commit data...
global-delete.js Loading commit data...
global-var-delete.js Loading commit data...
globals.js Loading commit data...
increment-typefeedback.js Loading commit data...
inline-accessors.js Loading commit data...
inline-arguments.js Loading commit data...
inline-arity-mismatch.js Loading commit data...
inline-closures.js Loading commit data...
inline-compare.js Loading commit data...
inline-conditional.js Loading commit data...
inline-construct.js Loading commit data...
inline-context-deopt.js Loading commit data...
inline-context-slots.js Loading commit data...
inline-dead-jscreate.js Loading commit data...
inline-exception-1.js Loading commit data...
inline-exception-2.js Loading commit data...
inline-function-apply.js Loading commit data...
inline-global-access.js Loading commit data...
inline-literals.js Loading commit data...
inline-omit-arguments-deopt.js Loading commit data...
inline-omit-arguments-object.js Loading commit data...
inline-omit-arguments.js Loading commit data...
inline-param.js Loading commit data...
inline-surplus-arguments-deopt.js Loading commit data...
inline-surplus-arguments-object.js Loading commit data...
inline-surplus-arguments.js Loading commit data...
inline-throw.js Loading commit data...
inline-two.js Loading commit data...
inlined-array-pop-getter1.js Loading commit data...
inlined-array-pop-getter2.js Loading commit data...
inlined-array-pop-opt.js Loading commit data...
inlined-call-mapcheck.js Loading commit data...
inlined-call.js Loading commit data...
instanceof-opt1.js Loading commit data...
instanceof-opt2.js Loading commit data...
instanceof-opt3.js Loading commit data...
instanceof.js Loading commit data...
integral32-add-sub.js Loading commit data...
lazy-const-lookup.js Loading commit data...
lazy-deopt-in-literal.js Loading commit data...
lazy-iife-no-parens.js Loading commit data...
literals-assignment.js Loading commit data...
literals-optimized.js Loading commit data...
literals.js Loading commit data...
load-elimination-global.js Loading commit data...
load-elimination-osr.js Loading commit data...
load-elimination-params.js Loading commit data...
load-elimination.js Loading commit data...
logical-and.js Loading commit data...
logical-or.js Loading commit data...
loopcount.js Loading commit data...
loops.js Loading commit data...
manual-concurrent-recompile.js Loading commit data...
math-floor-global.js Loading commit data...
math-floor-local.js Loading commit data...
math-mul.js Loading commit data...
math-sign.js Loading commit data...
minus-zero.js Loading commit data...
mul-div-52bit.js Loading commit data...
multiply-add.js Loading commit data...
multiply-sub.js Loading commit data...
named-load.js Loading commit data...
named-store.js Loading commit data...
null-compare.js Loading commit data...
number-isfinite.js Loading commit data...
number-isinteger.js Loading commit data...
number-isnan.js Loading commit data...
number-issafeinteger.js Loading commit data...
object-getprototypeof.js Loading commit data...
objectliterals.js Loading commit data...
opt-next-call-turbo.js Loading commit data...
opt-next-call.js Loading commit data...
optimize-bitnot.js Loading commit data...
optimize_max.js Loading commit data...
optimize_min.js Loading commit data...
optimized-closures.js Loading commit data...
optimized-float32array-length.js Loading commit data...
optimized-float64array-length.js Loading commit data...
optimized-for-in.js Loading commit data...
optimized-function-calls.js Loading commit data...
optimized-instanceof-1.js Loading commit data...
optimized-instanceof-2.js Loading commit data...
optimized-int32array-length.js Loading commit data...
optimized-uint32array-length.js Loading commit data...
osr-alignment.js Loading commit data...
osr-array-len.js Loading commit data...
osr-assert.js Loading commit data...
osr-backedges1.js Loading commit data...
osr-big.js Loading commit data...
osr-block-scope-func.js Loading commit data...
osr-block-scope-id.js Loading commit data...
osr-block-scope.js Loading commit data...
osr-follow.js Loading commit data...
osr-for-let.js Loading commit data...
osr-forin-nested.js Loading commit data...
osr-forin.js Loading commit data...
osr-forof.js Loading commit data...
osr-function-id.js Loading commit data...
osr-function-id2.js Loading commit data...
osr-function.js Loading commit data...
osr-infinite.js Loading commit data...
osr-labeled.js Loading commit data...
osr-literals-adapted.js Loading commit data...
osr-literals.js Loading commit data...
osr-manual1.js Loading commit data...
osr-manual2.js Loading commit data...
osr-maze1.js Loading commit data...
osr-maze2.js Loading commit data...
osr-multiple.js Loading commit data...
osr-multiple2.js Loading commit data...
osr-multiple3.js Loading commit data...
osr-nested.js Loading commit data...
osr-nested2.js Loading commit data...
osr-nested2b.js Loading commit data...
osr-nested3.js Loading commit data...
osr-nested3b.js Loading commit data...
osr-one.js Loading commit data...
osr-regex-id.js Loading commit data...
osr-regress-max-locals.js Loading commit data...
osr-sar.js Loading commit data...
osr-simple.js Loading commit data...
osr-top1.js Loading commit data...
osr-top2.js Loading commit data...
osr-top3.js Loading commit data...
osr-two.js Loading commit data...
osr-uint32.js Loading commit data...
osr-warm.js Loading commit data...
osr-while-let.js Loading commit data...
osr-with-args.js Loading commit data...
phi-representations.js Loading commit data...
pic.js Loading commit data...
property-calls.js Loading commit data...
property-refs.js Loading commit data...
property-simple.js Loading commit data...
property-static.js Loading commit data...
property-stores.js Loading commit data...
proto-chain-constant.js Loading commit data...
proto-chain-load.js Loading commit data...
receiver-conversion.js Loading commit data...
recursive-deopt.js Loading commit data...
reflect-getprototypeof.js Loading commit data...
regress-0.js Loading commit data...
regress-1.js Loading commit data...
regress-106351.js Loading commit data...
regress-1085.js Loading commit data...
regress-1394.js Loading commit data...
regress-177883.js Loading commit data...
regress-2.js Loading commit data...
regress-3.js Loading commit data...
regress-3136962.js Loading commit data...
regress-3185901.js Loading commit data...
regress-3218915.js Loading commit data...
regress-3249650.js Loading commit data...
regress-3260426.js Loading commit data...
regress-3786.js Loading commit data...
regress-3812.js Loading commit data...
regress-4.js Loading commit data...
regress-411262.js Loading commit data...
regress-416359.js Loading commit data...
regress-4206.js Loading commit data...
regress-4207.js Loading commit data...
regress-4389-1.js Loading commit data...
regress-4389-2.js Loading commit data...
regress-4389-3.js Loading commit data...
regress-4389-4.js Loading commit data...
regress-4389-5.js Loading commit data...
regress-4389-6.js Loading commit data...
regress-439743.js Loading commit data...
regress-4413-1.js Loading commit data...
regress-443744.js Loading commit data...
regress-444508.js Loading commit data...
regress-444695.js Loading commit data...
regress-445267.js Loading commit data...
regress-445732.js Loading commit data...
regress-445858.js Loading commit data...
regress-445859.js Loading commit data...
regress-445876.js Loading commit data...
regress-445907.js Loading commit data...
regress-446156.js Loading commit data...
regress-446647.js Loading commit data...
regress-446778.js Loading commit data...
regress-4470-1.js Loading commit data...
regress-447567.js Loading commit data...
regress-451012.js Loading commit data...
regress-452427.js Loading commit data...
regress-463056.js Loading commit data...
regress-468162.js Loading commit data...
regress-468727.js Loading commit data...
regress-469089.js Loading commit data...
regress-491578.js Loading commit data...
regress-5.js Loading commit data...
regress-5074.js Loading commit data...
regress-5100.js Loading commit data...
regress-5129.js Loading commit data...
regress-5158.js Loading commit data...
regress-5278.js Loading commit data...
regress-5320.js Loading commit data...
regress-5538.js Loading commit data...
regress-572409.js Loading commit data...
regress-6.js Loading commit data...
regress-600593.js Loading commit data...
regress-607493.js Loading commit data...
regress-621147.js Loading commit data...
regress-621423.js Loading commit data...
regress-625558.js Loading commit data...
regress-625966.js Loading commit data...
regress-626986.js Loading commit data...
regress-628403.js Loading commit data...
regress-628516.js Loading commit data...
regress-628773.js Loading commit data...
regress-630611.js Loading commit data...
regress-633497.js Loading commit data...
regress-638132.js Loading commit data...
regress-639210.js Loading commit data...
regress-644048.js Loading commit data...
regress-644633.js Loading commit data...
regress-645851.js Loading commit data...
regress-650215.js Loading commit data...
regress-664117.js Loading commit data...
regress-664490.js Loading commit data...
regress-665680.js Loading commit data...
regress-668760.js Loading commit data...
regress-669517.js Loading commit data...
regress-671574.js Loading commit data...
regress-673244.js Loading commit data...
regress-674469.js Loading commit data...
regress-675704.js Loading commit data...
regress-693425.js Loading commit data...
regress-694088.js Loading commit data...
regress-7.js Loading commit data...
regress-700883.js Loading commit data...
regress-713367.js Loading commit data...
regress-714483.js Loading commit data...
regress-715204.js Loading commit data...
regress-715651.js Loading commit data...
regress-8.js Loading commit data...
regress-arguments.js Loading commit data...
regress-arrayliteral.js Loading commit data...
regress-bit-number-constant.js Loading commit data...
regress-closures-with-eval.js Loading commit data...
regress-compare-negate.js Loading commit data...
regress-const.js Loading commit data...
regress-crbug-540593.js Loading commit data...
regress-dead-throw-inlining.js Loading commit data...
regress-deopt-call-as-function.js Loading commit data...
regress-escape-analysis-indirect.js Loading commit data...
regress-f64-w32-change.js Loading commit data...
regress-funarguments.js Loading commit data...
regress-funcaller.js Loading commit data...
regress-gap.js Loading commit data...
regress-gvn.js Loading commit data...
regress-inline-callfunctionstub.js Loading commit data...
regress-int32array-outofbounds-nan.js Loading commit data...
regress-intoverflow.js Loading commit data...
regress-lazy-deopt.js Loading commit data...
regress-lbranch-double.js Loading commit data...
regress-loadfield.js Loading commit data...
regress-loop-deopt.js Loading commit data...
regress-loop-variable-if.js Loading commit data...
regress-loop-variable-unsigned.js Loading commit data...
regress-math-sign-nan-type.js Loading commit data...
regress-max.js Loading commit data...
regress-ntl-effect.js Loading commit data...
regress-number-is-hole-nan.js Loading commit data...
regress-or.js Loading commit data...
regress-register-allocator.js Loading commit data...
regress-register-allocator2.js Loading commit data...
regress-register-allocator3.js Loading commit data...
regress-rep-change.js Loading commit data...
regress-serialized-slots.js Loading commit data...
regress-shared-deopt.js Loading commit data...
regress-shift-left.js Loading commit data...
regress-shift-right-logical.js Loading commit data...
regress-shift-right.js Loading commit data...
regress-stacktrace-methods.js Loading commit data...
regress-stacktrace.js Loading commit data...
regress-store-holey-double-array.js Loading commit data...
regress-string-to-number-add.js Loading commit data...
regress-to-number-binop-deopt.js Loading commit data...
regress-toint32.js Loading commit data...
regress-truncate-number-or-undefined-to-float64.js Loading commit data...
regress-v8-5573.js Loading commit data...
regress-v8-5756.js Loading commit data...
regress-v8-6077.js Loading commit data...
regress-variable-liveness-let.js Loading commit data...
regress-variable-liveness.js Loading commit data...
rest-parameters.js Loading commit data...
rotate.js Loading commit data...
safepoint.js Loading commit data...
shift-shr.js Loading commit data...
short-circuit.js Loading commit data...
simple-bailouts.js Loading commit data...
simple-binary-op.js Loading commit data...
simple-deopt.js Loading commit data...
simple-global-access.js Loading commit data...
simple-inlining.js Loading commit data...
smi-stores-opt.js Loading commit data...
store-elimination.js Loading commit data...
strict-recompile.js Loading commit data...
string-add-try-catch.js Loading commit data...
string-length.js Loading commit data...
switch-bailout.js Loading commit data...
symbol-protototype.js Loading commit data...
this-property-refs.js Loading commit data...
thisfunction.js Loading commit data...
to-fast-properties.js Loading commit data...
truncating-store-deopt.js Loading commit data...
truncating-store.js Loading commit data...
try-binop.js Loading commit data...
try-catch-deopt.js Loading commit data...
try-context.js Loading commit data...
try-deopt.js Loading commit data...
try-finally-deopt.js Loading commit data...
try-osr.js Loading commit data...
turbo-number-feedback.js Loading commit data...
uint32.js Loading commit data...
uint8-clamped-array.js Loading commit data...
unary-add.js Loading commit data...
unsigned-min-max.js Loading commit data...
variables.js Loading commit data...