From 364cec00343628c493cf8d4a39f251fd95f6aa99 Mon Sep 17 00:00:00 2001 From: "jarin@chromium.org" Date: Fri, 7 Nov 2014 14:07:18 +0000 Subject: [PATCH] [turbofan] Fix deoptimization of uint8, uint16 inputs. BUG= R=mstarzinger@chromium.org Review URL: https://codereview.chromium.org/707443003 Cr-Commit-Position: refs/heads/master@{#25214} git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@25214 ce2b1a6d-e550-0410-aec6-3dcde31c8c00 --- src/compiler/code-generator.cc | 6 ++++-- src/compiler/linkage.cc | 1 + test/mjsunit/compiler/regress-uint8-deopt.js | 17 +++++++++++++++++ 3 files changed, 22 insertions(+), 2 deletions(-) create mode 100644 test/mjsunit/compiler/regress-uint8-deopt.js diff --git a/src/compiler/code-generator.cc b/src/compiler/code-generator.cc index 6b04eef..708b18e 100644 --- a/src/compiler/code-generator.cc +++ b/src/compiler/code-generator.cc @@ -422,7 +422,8 @@ void CodeGenerator::AddTranslationForOperand(Translation* translation, if (type == kMachBool || type == kMachInt32 || type == kMachInt8 || type == kMachInt16) { translation->StoreInt32StackSlot(op->index()); - } else if (type == kMachUint32) { + } else if (type == kMachUint32 || type == kMachUint16 || + type == kMachUint8) { translation->StoreUint32StackSlot(op->index()); } else if ((type & kRepMask) == kRepTagged) { translation->StoreStackSlot(op->index()); @@ -437,7 +438,8 @@ void CodeGenerator::AddTranslationForOperand(Translation* translation, if (type == kMachBool || type == kMachInt32 || type == kMachInt8 || type == kMachInt16) { translation->StoreInt32Register(converter.ToRegister(op)); - } else if (type == kMachUint32) { + } else if (type == kMachUint32 || type == kMachUint16 || + type == kMachUint8) { translation->StoreUint32Register(converter.ToRegister(op)); } else if ((type & kRepMask) == kRepTagged) { translation->StoreRegister(converter.ToRegister(op)); diff --git a/src/compiler/linkage.cc b/src/compiler/linkage.cc index a97e484..16529b4 100644 --- a/src/compiler/linkage.cc +++ b/src/compiler/linkage.cc @@ -186,6 +186,7 @@ bool Linkage::NeedsFrameState(Runtime::FunctionId function) { case Runtime::kRegExpCompile: case Runtime::kRegExpExecMultiple: case Runtime::kResolvePossiblyDirectEval: + case Runtime::kRunMicrotasks: case Runtime::kSetPrototype: case Runtime::kSetScriptBreakPoint: case Runtime::kSparseJoinWithSeparator: diff --git a/test/mjsunit/compiler/regress-uint8-deopt.js b/test/mjsunit/compiler/regress-uint8-deopt.js new file mode 100644 index 0000000..ba2823f --- /dev/null +++ b/test/mjsunit/compiler/regress-uint8-deopt.js @@ -0,0 +1,17 @@ +// Copyright 2014 the V8 project authors. All rights reserved. +// Use of this source code is governed by a BSD-style license that can be +// found in the LICENSE file. + +// Flags: --turbo-asm --turbo-deoptimization --allow-natives-syntax + +function Module(heap) { + "use asm"; + var a = new Uint8Array(heap); + function f() { + var x = a[0] | 0; + %DeoptimizeFunction(f); + return x; + } + return f; +} +assertEquals(0, Module(new ArrayBuffer(1))()); -- 2.7.4