Treat HArgumentsObject as a safe use during Uint32 analysis phase.
authorvegorov <vegorov@google.com>
Mon, 13 Apr 2015 10:47:19 +0000 (03:47 -0700)
committerCommit bot <commit-bot@chromium.org>
Mon, 13 Apr 2015 10:47:15 +0000 (10:47 +0000)
commit021f738127406ef6ff8868465ff32b59edaff016
tree0e03986fc5d53962caefb21b342e6c0823ea9913
parent0f432ebb76350a69d59edc303c181c8ba1719c96
Treat HArgumentsObject as a safe use during Uint32 analysis phase.

Deoptimization infrastructure already handles it correctly.

This change fixes repetitive deoptimizations in the code like this:

    var u32 = new Uint32Array(1);
    u32[0] = -1;

    function tr(x) { return x|0; }
    function ld() { return tr(u32[0]); }

    while (true) ld();

Currently inlined tr will contain HArgumentsObject that is considered uint32-unsafe use and prevents u32[0] from becoming uint32 load - instead a speculative int32 load is generated which just deopts.

BUG=

Review URL: https://codereview.chromium.org/1077113002

Cr-Commit-Position: refs/heads/master@{#27781}
src/deoptimizer.cc
src/hydrogen-uint32-analysis.cc
test/mjsunit/compiler/uint32.js