[turbofan] Fix deoptimization of uint8, uint16 inputs.

BUG=
R=mstarzinger@chromium.org

Review URL: https://codereview.chromium.org/707443003

Cr-Commit-Position: refs/heads/master@{#25214}
git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@25214 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

diff --git a/src/compiler/code-generator.cc b/src/compiler/code-generator.cc
index 6b04eef..708b18e 100644 (file)
--- a/src/compiler/code-generator.cc
+++ b/src/compiler/code-generator.cc
@@ -422,7 +422,8 @@ void CodeGenerator::AddTranslationForOperand(Translation* translation,
     if (type == kMachBool || type == kMachInt32 || type == kMachInt8 ||
         type == kMachInt16) {
       translation->StoreInt32StackSlot(op->index());
-    } else if (type == kMachUint32) {
+    } else if (type == kMachUint32 || type == kMachUint16 ||
+               type == kMachUint8) {
       translation->StoreUint32StackSlot(op->index());
     } else if ((type & kRepMask) == kRepTagged) {
       translation->StoreStackSlot(op->index());
@@ -437,7 +438,8 @@ void CodeGenerator::AddTranslationForOperand(Translation* translation,
     if (type == kMachBool || type == kMachInt32 || type == kMachInt8 ||
         type == kMachInt16) {
       translation->StoreInt32Register(converter.ToRegister(op));
-    } else if (type == kMachUint32) {
+    } else if (type == kMachUint32 || type == kMachUint16 ||
+               type == kMachUint8) {
       translation->StoreUint32Register(converter.ToRegister(op));
     } else if ((type & kRepMask) == kRepTagged) {
       translation->StoreRegister(converter.ToRegister(op));

diff --git a/src/compiler/linkage.cc b/src/compiler/linkage.cc
index a97e484..16529b4 100644 (file)
--- a/src/compiler/linkage.cc
+++ b/src/compiler/linkage.cc
@@ -186,6 +186,7 @@ bool Linkage::NeedsFrameState(Runtime::FunctionId function) {
     case Runtime::kRegExpCompile:
     case Runtime::kRegExpExecMultiple:
     case Runtime::kResolvePossiblyDirectEval:
+    case Runtime::kRunMicrotasks:
     case Runtime::kSetPrototype:
     case Runtime::kSetScriptBreakPoint:
     case Runtime::kSparseJoinWithSeparator:

diff --git a/test/mjsunit/compiler/regress-uint8-deopt.js b/test/mjsunit/compiler/regress-uint8-deopt.js
new file mode 100644 (file)
index 0000000..ba2823f
--- /dev/null
+++ b/test/mjsunit/compiler/regress-uint8-deopt.js
@@ -0,0 +1,17 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --turbo-asm --turbo-deoptimization --allow-natives-syntax
+
+function Module(heap) {
+  "use asm";
+  var a = new Uint8Array(heap);
+  function f() {
+    var x = a[0] | 0;
+    %DeoptimizeFunction(f);
+    return x;
+  }
+  return f;
+}
+assertEquals(0, Module(new ArrayBuffer(1))());