Merge V8 5.3.332.45. DO NOT MERGE
Test: Manual
FPIIM-449
Change-Id: Id3254828b068abdea3cb10442e0172a8c9a98e03
(cherry picked from commit 13e2dadd00298019ed862f2b2fc5068bba730bcf)
diff --git a/src/compiler/js-call-reducer.cc b/src/compiler/js-call-reducer.cc
index b3561e9..f4b0d7b 100644
--- a/src/compiler/js-call-reducer.cc
+++ b/src/compiler/js-call-reducer.cc
@@ -71,7 +71,6 @@
size_t const arity = p.arity() - 2;
NodeProperties::ReplaceValueInput(node, target, 0);
NodeProperties::ReplaceValueInput(node, target, 1);
- NodeProperties::RemoveFrameStateInput(node, 1);
// TODO(bmeurer): We might need to propagate the tail call mode to
// the JSCreateArray operator, because an Array call in tail call
// position must always properly consume the parent stack frame.
@@ -89,7 +88,6 @@
DCHECK_LE(2u, p.arity());
Node* value = (p.arity() == 2) ? jsgraph()->ZeroConstant()
: NodeProperties::GetValueInput(node, 2);
- NodeProperties::RemoveFrameStateInput(node, 1);
NodeProperties::ReplaceValueInputs(node, value);
NodeProperties::ChangeOp(node, javascript()->ToNumber());
return Changed(node);
@@ -220,9 +218,9 @@
CallFunctionParameters const& p = CallFunctionParametersOf(node->op());
Node* target = NodeProperties::GetValueInput(node, 0);
Node* context = NodeProperties::GetContextInput(node);
- Node* frame_state = NodeProperties::GetFrameStateInput(node, 1);
Node* control = NodeProperties::GetControlInput(node);
Node* effect = NodeProperties::GetEffectInput(node);
+ Node* frame_state = NodeProperties::FindFrameStateBefore(node);
// Try to specialize JSCallFunction {node}s with constant {target}s.
HeapObjectMatcher m(target);
@@ -233,7 +231,6 @@
// Raise a TypeError if the {target} is a "classConstructor".
if (IsClassConstructor(shared->kind())) {
- NodeProperties::RemoveFrameStateInput(node, 0);
NodeProperties::ReplaceValueInputs(node, target);
NodeProperties::ChangeOp(
node, javascript()->CallRuntime(
@@ -272,7 +269,7 @@
isolate());
CallFunctionParameters const& p = CallFunctionParametersOf(node->op());
ConvertReceiverMode const convert_mode =
- (bound_this->IsNull() || bound_this->IsUndefined())
+ (bound_this->IsNull(isolate()) || bound_this->IsUndefined(isolate()))
? ConvertReceiverMode::kNullOrUndefined
: ConvertReceiverMode::kNotNullOrUndefined;
size_t arity = p.arity();
@@ -326,10 +323,11 @@
}
// Check that the {target} is still the {array_function}.
- Node* check = graph()->NewNode(javascript()->StrictEqual(), target,
- array_function, context);
- control = graph()->NewNode(common()->DeoptimizeUnless(), check, frame_state,
- effect, control);
+ Node* check = graph()->NewNode(
+ javascript()->StrictEqual(CompareOperationHints::Any()), target,
+ array_function, context);
+ control = effect = graph()->NewNode(common()->DeoptimizeUnless(), check,
+ frame_state, effect, control);
// Turn the {node} into a {JSCreateArray} call.
NodeProperties::ReplaceValueInput(node, array_function, 0);
@@ -343,13 +341,15 @@
jsgraph()->Constant(handle(cell->value(), isolate()));
// Check that the {target} is still the {target_function}.
- Node* check = graph()->NewNode(javascript()->StrictEqual(), target,
- target_function, context);
- control = graph()->NewNode(common()->DeoptimizeUnless(), check,
- frame_state, effect, control);
+ Node* check = graph()->NewNode(
+ javascript()->StrictEqual(CompareOperationHints::Any()), target,
+ target_function, context);
+ control = effect = graph()->NewNode(common()->DeoptimizeUnless(), check,
+ frame_state, effect, control);
// Specialize the JSCallFunction node to the {target_function}.
NodeProperties::ReplaceValueInput(node, target_function, 0);
+ NodeProperties::ReplaceEffectInput(node, effect);
NodeProperties::ReplaceControlInput(node, control);
// Try to further reduce the JSCallFunction {node}.
@@ -369,9 +369,9 @@
Node* target = NodeProperties::GetValueInput(node, 0);
Node* new_target = NodeProperties::GetValueInput(node, arity + 1);
Node* context = NodeProperties::GetContextInput(node);
- Node* frame_state = NodeProperties::GetFrameStateInput(node, 1);
Node* effect = NodeProperties::GetEffectInput(node);
Node* control = NodeProperties::GetControlInput(node);
+ Node* frame_state = NodeProperties::FindFrameStateBefore(node);
// Try to specialize JSCallConstruct {node}s with constant {target}s.
HeapObjectMatcher m(target);
@@ -381,11 +381,6 @@
// Raise a TypeError if the {target} is not a constructor.
if (!function->IsConstructor()) {
- // Drop the lazy bailout location and use the eager bailout point for
- // the runtime function (actually as lazy bailout point). It doesn't
- // really matter which bailout location we use since we never really
- // go back after throwing the exception.
- NodeProperties::RemoveFrameStateInput(node, 0);
NodeProperties::ReplaceValueInputs(node, target);
NodeProperties::ChangeOp(
node, javascript()->CallRuntime(Runtime::kThrowCalledNonCallable));
@@ -405,7 +400,6 @@
}
// Turn the {node} into a {JSCreateArray} call.
- NodeProperties::RemoveFrameStateInput(node, 1);
for (int i = arity; i > 0; --i) {
NodeProperties::ReplaceValueInput(
node, NodeProperties::GetValueInput(node, i), i + 1);
@@ -451,15 +445,15 @@
}
// Check that the {target} is still the {array_function}.
- Node* check = graph()->NewNode(javascript()->StrictEqual(), target,
- array_function, context);
- control = graph()->NewNode(common()->DeoptimizeUnless(), check, frame_state,
- effect, control);
+ Node* check = graph()->NewNode(
+ javascript()->StrictEqual(CompareOperationHints::Any()), target,
+ array_function, context);
+ control = effect = graph()->NewNode(common()->DeoptimizeUnless(), check,
+ frame_state, effect, control);
// Turn the {node} into a {JSCreateArray} call.
NodeProperties::ReplaceEffectInput(node, effect);
NodeProperties::ReplaceControlInput(node, control);
- NodeProperties::RemoveFrameStateInput(node, 1);
for (int i = arity; i > 0; --i) {
NodeProperties::ReplaceValueInput(
node, NodeProperties::GetValueInput(node, i), i + 1);
@@ -474,10 +468,11 @@
jsgraph()->Constant(handle(cell->value(), isolate()));
// Check that the {target} is still the {target_function}.
- Node* check = graph()->NewNode(javascript()->StrictEqual(), target,
- target_function, context);
- control = graph()->NewNode(common()->DeoptimizeUnless(), check,
- frame_state, effect, control);
+ Node* check = graph()->NewNode(
+ javascript()->StrictEqual(CompareOperationHints::Any()), target,
+ target_function, context);
+ control = effect = graph()->NewNode(common()->DeoptimizeUnless(), check,
+ frame_state, effect, control);
// Specialize the JSCallConstruct node to the {target_function}.
NodeProperties::ReplaceValueInput(node, target_function, 0);