New issue
Advanced search Search tips

Issue 662904 link

Starred by 1 user

Issue metadata

Status: Fixed
Owner:
Closed: Nov 2016
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: ----
Pri: 1
Type: Bug

Blocking:
issue 662423



Sign in to add a comment

Difference between fullcode and crankshaft_opt: mock_arguments

Project Member Reported by machenb...@chromium.org, Nov 7 2016

Issue description

# Tried to mock out arguments. This flushed out another problem. Minimized testcase:
Object.prototype.mock_arguments = ['x', 'y']

function foo(a) {
  var sum = 0;
  for (var i in a) {
    var tmp = a[i] + 2 + 5 + 3;
    a = new Array();
    sum += tmp;
  }
  return sum;
}
a = new Array();
for (var i = 0; i < 10000; i++) {
  a[i] = (i * 999);
}
foo(a);
print(foo(a));


# Compared nocrankshaft with noturbo_opt

# Flags of nocrankshaft:
--abort_on_stack_overflow --expose-gc --allow-natives-syntax --invoke-weak-callbacks --omit-quit  --random-seed 1681183061 --nocrankshaft
# Flags of noturbo_opt:
--abort_on_stack_overflow --expose-gc --allow-natives-syntax --invoke-weak-callbacks --omit-quit  --random-seed 1681183061 --always-opt --turbo-filter=~

Difference:
- NaNx,y253
+ NaNx,y253x,y253

### Start of configuration nocrankshaft:
NaNx,y253

### End of configuration nocrankshaft

### Start of configuration noturbo_opt:
NaNx,y253x,y253

### End of configuration noturbo_opt

 
Project Member

Comment 1 by bugdroid1@chromium.org, Nov 8 2016

The following revision refers to this bug:
  https://chromium.googlesource.com/v8/v8.git/+/5d898441308f8cc47f22970917364b32189c220e

commit 5d898441308f8cc47f22970917364b32189c220e
Author: jarin <jarin@chromium.org>
Date: Tue Nov 08 12:33:33 2016

[crankshaft] FIx for in deopt at the end of the loop.

We really should deopt before the for-in index increment.

BUG= chromium:662904 

Review-Url: https://codereview.chromium.org/2476423003
Cr-Commit-Position: refs/heads/master@{#40828}

[modify] https://crrev.com/5d898441308f8cc47f22970917364b32189c220e/src/ast/ast.h
[modify] https://crrev.com/5d898441308f8cc47f22970917364b32189c220e/src/crankshaft/hydrogen.cc
[add] https://crrev.com/5d898441308f8cc47f22970917364b32189c220e/test/mjsunit/regress/regress-662904.js

Comment 2 by danno@chromium.org, Nov 17 2016

Owner: jarin@chromium.org
Status: Assigned (was: Untriaged)

Comment 3 by jarin@chromium.org, Nov 22 2016

Status: Fixed (was: Assigned)
Labels: -Restrict-View-Google v8-foozzie-failure

Sign in to add a comment