From 58661c150f32ae580dcf6c88f1ef798e69049271 Mon Sep 17 00:00:00 2001 From: "jkummerow@chromium.org" Date: Wed, 21 May 2014 08:51:29 +0000 Subject: [PATCH] Fix ArrayShift hydrogen support BUG=chromium:374838 LOG=y R=bmeurer@chromium.org Review URL: https://codereview.chromium.org/299713003 git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@21401 ce2b1a6d-e550-0410-aec6-3dcde31c8c00 --- src/hydrogen-instructions.h | 1 + src/hydrogen.cc | 4 ---- test/mjsunit/regress/regress-crbug-374838.js | 20 ++++++++++++++++++++ 3 files changed, 21 insertions(+), 4 deletions(-) create mode 100644 test/mjsunit/regress/regress-crbug-374838.js diff --git a/src/hydrogen-instructions.h b/src/hydrogen-instructions.h index 918229b..cf3497f 100644 --- a/src/hydrogen-instructions.h +++ b/src/hydrogen-instructions.h @@ -7123,6 +7123,7 @@ class HArrayShift V8_FINAL : public HTemplateInstruction<2> { : kind_(kind) { SetOperandAt(0, context); SetOperandAt(1, object); + SetChangesFlag(kArrayLengths); SetChangesFlag(kNewSpacePromotion); set_representation(Representation::Tagged()); if (IsFastSmiOrObjectElementsKind(kind)) { diff --git a/src/hydrogen.cc b/src/hydrogen.cc index 40386aa..b296b93 100644 --- a/src/hydrogen.cc +++ b/src/hydrogen.cc @@ -7927,10 +7927,6 @@ bool HOptimizedGraphBuilder::TryInlineBuiltinMethodCall( return true; } case kArrayShift: { - // Something in here seems to be causing crbug.com/374838. - // TODO(bmeurer): Investigate the problem and re-enable this code. - return false; - if (receiver_map.is_null()) return false; if (receiver_map->instance_type() != JS_ARRAY_TYPE) return false; ElementsKind kind = receiver_map->elements_kind(); diff --git a/test/mjsunit/regress/regress-crbug-374838.js b/test/mjsunit/regress/regress-crbug-374838.js new file mode 100644 index 0000000..614b4d9 --- /dev/null +++ b/test/mjsunit/regress/regress-crbug-374838.js @@ -0,0 +1,20 @@ +// Copyright 2014 the V8 project authors. All rights reserved. +// Use of this source code is governed by a BSD-style license that can be +// found in the LICENSE file. + +// Flags: --allow-natives-syntax + +function foo() { + var a = [0]; + result = 0; + for (var i = 0; i < 4; i++) { + result += a.length; + a.shift(); + } + return result; +} + +assertEquals(1, foo()); +assertEquals(1, foo()); +%OptimizeFunctionOnNextCall(foo); +assertEquals(1, foo()); -- 2.7.4