OLD | NEW |
---|---|
1 // Copyright 2012 the V8 project authors. All rights reserved. | 1 // Copyright 2012 the V8 project authors. All rights reserved. |
2 // Redistribution and use in source and binary forms, with or without | 2 // Redistribution and use in source and binary forms, with or without |
3 // modification, are permitted provided that the following conditions are | 3 // modification, are permitted provided that the following conditions are |
4 // met: | 4 // met: |
5 // | 5 // |
6 // * Redistributions of source code must retain the above copyright | 6 // * Redistributions of source code must retain the above copyright |
7 // notice, this list of conditions and the following disclaimer. | 7 // notice, this list of conditions and the following disclaimer. |
8 // * Redistributions in binary form must reproduce the above | 8 // * Redistributions in binary form must reproduce the above |
9 // copyright notice, this list of conditions and the following | 9 // copyright notice, this list of conditions and the following |
10 // disclaimer in the documentation and/or other materials provided | 10 // disclaimer in the documentation and/or other materials provided |
11 // with the distribution. | 11 // with the distribution. |
12 // * Neither the name of Google Inc. nor the names of its | 12 // * Neither the name of Google Inc. nor the names of its |
13 // contributors may be used to endorse or promote products derived | 13 // contributors may be used to endorse or promote products derived |
14 // from this software without specific prior written permission. | 14 // from this software without specific prior written permission. |
15 // | 15 // |
16 // THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS | 16 // THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS |
17 // "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT | 17 // "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT |
18 // LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR | 18 // LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR |
19 // A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT | 19 // A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT |
20 // OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, | 20 // OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, |
21 // SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT | 21 // SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT |
22 // LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, | 22 // LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, |
23 // DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY | 23 // DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY |
24 // THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT | 24 // THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT |
25 // (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE | 25 // (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE |
26 // OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. | 26 // OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. |
27 | 27 |
28 // Flags: --allow-natives-syntax | 28 // Flags: --allow-natives-syntax |
29 | 29 |
30 // Test function.arguments. | 30 // Create elements in a constructor function to ensure map sharing. |
31 | 31 function TestConstructor() { |
32 function A() {} | 32 this[0] = 1; |
33 function B() {} | 33 this[1] = 2; |
34 | 34 this[2] = 3; |
35 function fee(x, y) { | |
36 if (x == 1) return fee["arg" + "uments"]; | |
37 if (x == 2) return gee["arg" + "uments"]; | |
38 return 42; | |
39 } | 35 } |
40 | 36 |
41 function gee(x) { return this.f(2 - x, "f"); } | 37 function bad_func(o,a) { |
42 | 38 var s = 0; |
43 function foo(x, y) { | 39 for (var i = 0; i < 1; ++i) { |
44 if (x == 0) return foo["arg" + "uments"]; | 40 o.newFileToChangeMap = undefined; |
45 if (x == 1) return goo["arg" + "uments"]; | 41 var x = a[0]; |
46 return 42; | 42 s += x; |
43 } | |
44 return s; | |
47 } | 45 } |
48 | 46 |
49 function goo(x) { return this.f(x, "f"); } | 47 o = new Object(); |
48 a = new TestConstructor(); | |
49 bad_func(o, a); | |
50 | 50 |
51 A.prototype.f = fee; | 51 // Make sure that we're out of pre-monomorphic state for the member add of |
52 A.prototype.g = gee; | 52 // 'newFileToChangeMap' which causes a map transition. |
53 o = new Object(); | |
54 a = new TestConstructor(); | |
55 bad_func(o, a); | |
53 | 56 |
54 B.prototype.f = foo; | 57 // Optimize, before the fix, the element load and subsequent tagged-to-i were |
55 B.prototype.g = goo; | 58 // hoisted above the map check, which can't be hoisted due map-changing store |
59 // that adds | |
Jakob Kummerow
2012/07/23 13:54:23
nit: this sentence is still incomplete.
| |
60 o = new Object(); | |
61 a = new TestConstructor(); | |
62 %OptimizeFunctionOnNextCall(bad_func); | |
63 bad_func(o, a); | |
56 | 64 |
57 var o = new A(); | 65 // Pass in a array of doubles. Before the fix, the optimized load and |
58 | 66 // tagged-to-i will treat part of a double value as a pointer and de-ref it |
59 function hej(x) { | 67 // before the map check was executed that should have deopt. |
60 if (x == 0) return o.g(x, "h"); | 68 o = new Object(); |
61 if (x == 1) return o.g(x, "h"); | 69 // Pass in an elements buffer where the bit representation of the double numbers |
62 return o.g(x, "z"); | 70 // are two adjacent small 32-bit values with the lowest bit set to one, causing |
63 } | 71 // tagged-to-i to SIGSEGV. |
64 | 72 a = [2.122e-314, 2.122e-314, 2.122e-314]; |
65 function opt() { | 73 bad_func(o, a); |
66 for (var k=0; k<2; k++) { | |
67 for (var i=0; i<5; i++) o.g(i, "g"); | |
68 for (var j=0; j<5; j++) hej(j); | |
69 } | |
70 %OptimizeFunctionOnNextCall(o.g); | |
71 %OptimizeFunctionOnNextCall(hej); | |
72 } | |
73 | |
74 opt(); | |
75 assertArrayEquals([0, "g"], o.g(0, "g")); | |
76 assertArrayEquals([1, "f"], o.g(1, "g")); | |
77 assertArrayEquals([0, "h"], hej(0)); | |
78 assertArrayEquals([1, "f"], hej(1)); | |
79 | |
80 o = new B(); | |
81 | |
82 opt(); | |
83 assertArrayEquals([0, "f"], o.g(0, "g")); | |
84 assertArrayEquals([1, "g"], o.g(1, "g")); | |
85 assertArrayEquals([0, "f"], hej(0)); | |
86 assertArrayEquals([1, "h"], hej(1)); | |
OLD | NEW |