From d313551a3e560c69cab5f3fba71bdd6d815c700b Mon Sep 17 00:00:00 2001 From: "mstarzinger@chromium.org" Date: Tue, 16 Sep 2014 08:29:46 +0000 Subject: [PATCH] Disable lowering to StringAdd due to various issues. R=titzer@chromium.org Review URL: https://codereview.chromium.org/566303003 git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@23961 ce2b1a6d-e550-0410-aec6-3dcde31c8c00 --- src/compiler/js-typed-lowering.cc | 6 ++++++ test/cctest/compiler/test-js-typed-lowering.cc | 3 +++ test/mjsunit/mjsunit.status | 9 --------- test/mjsunit/regress/regress-crbug-357052.js | 1 + test/mjsunit/string-oom-concat.js | 1 + 5 files changed, 11 insertions(+), 9 deletions(-) diff --git a/src/compiler/js-typed-lowering.cc b/src/compiler/js-typed-lowering.cc index 9f1e7eb..38671a2 100644 --- a/src/compiler/js-typed-lowering.cc +++ b/src/compiler/js-typed-lowering.cc @@ -232,6 +232,11 @@ Reduction JSTypedLowering::ReduceJSAdd(Node* node) { r.ConvertInputsToNumber(); return r.ChangeToPureOperator(simplified()->NumberAdd()); } +#if 0 + // TODO(turbofan): Lowering of StringAdd is disabled for now because: + // a) The inserted ToString operation screws up valueOf vs. toString order. + // b) Deoptimization at ToString doesn't have corresponding bailout id. + // c) Our current StringAddStub is actually non-pure and requires context. if (r.OneInputIs(Type::String())) { // JSAdd(x:string, y:string) => StringAdd(x, y) // JSAdd(x:string, y) => StringAdd(x, ToString(y)) @@ -239,6 +244,7 @@ Reduction JSTypedLowering::ReduceJSAdd(Node* node) { r.ConvertInputsToString(); return r.ChangeToPureOperator(simplified()->StringAdd()); } +#endif return NoChange(); } diff --git a/test/cctest/compiler/test-js-typed-lowering.cc b/test/cctest/compiler/test-js-typed-lowering.cc index 787918f..fb63583 100644 --- a/test/cctest/compiler/test-js-typed-lowering.cc +++ b/test/cctest/compiler/test-js-typed-lowering.cc @@ -186,6 +186,8 @@ static IrOpcode::Value NumberToI32(bool is_signed) { } +// TODO(turbofan): Lowering of StringAdd is disabled for now. +#if 0 TEST(StringBinops) { JSTypedLoweringTester R; @@ -204,6 +206,7 @@ TEST(StringBinops) { } } } +#endif TEST(AddNumber1) { diff --git a/test/mjsunit/mjsunit.status b/test/mjsunit/mjsunit.status index 55fedd2..6d0aa51 100644 --- a/test/mjsunit/mjsunit.status +++ b/test/mjsunit/mjsunit.status @@ -70,15 +70,6 @@ 'harmony/block-let-crankshaft': [PASS, NO_VARIANTS], 'harmony/empty-for': [PASS, NO_VARIANTS], - # TODO(mstarzinger): Typed lowering screws up valueOf vs. toString order. - 'regress/regress-760-1': [PASS, NO_VARIANTS], - 'regress/regress-760-2': [PASS, NO_VARIANTS], - 'harmony/proxies-json': [PASS, NO_VARIANTS], - - # Unused code is optimized away, think about fixing the test case. - 'string-oom-concat': [PASS, NO_VARIANTS], - 'regress/regress-crbug-357052': [PASS, NO_VARIANTS], - # Some tests are over-restrictive about object layout. 'array-constructor-feedback': [PASS, NO_VARIANTS], 'array-feedback': [PASS, NO_VARIANTS], diff --git a/test/mjsunit/regress/regress-crbug-357052.js b/test/mjsunit/regress/regress-crbug-357052.js index 9cde1b6..7a58396 100644 --- a/test/mjsunit/regress/regress-crbug-357052.js +++ b/test/mjsunit/regress/regress-crbug-357052.js @@ -7,5 +7,6 @@ function f() { for (var i = 0; i < 30; i++) { str += "abcdefgh12345678" + str; } + return str; } assertThrows(f); diff --git a/test/mjsunit/string-oom-concat.js b/test/mjsunit/string-oom-concat.js index 9529c89..0b35021 100644 --- a/test/mjsunit/string-oom-concat.js +++ b/test/mjsunit/string-oom-concat.js @@ -7,6 +7,7 @@ function concat() { for (var i = 0; i < 100; i++) { a += a; } + return a; } assertThrows(concat, RangeError); -- 2.7.4