|
| 1 | +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 |
| 2 | +From: Darius Mercadier <dmercadier@chromium.org> |
| 3 | +Date: Wed, 25 Feb 2026 12:56:18 +0100 |
| 4 | +Subject: [M144 Merge] [maglev] fix CanElideWriteBarrier Smi recording for phis |
| 5 | + |
| 6 | +Recording a Tagged use is not enough for 2 reasons: |
| 7 | + |
| 8 | + * Tagged uses are sometimes ignored, in particular for loop phis |
| 9 | + where we distinguish in-loop and out-of-loop uses. |
| 10 | + |
| 11 | + * This Tagged use could only prevent untagging of this specific phi, |
| 12 | + but none of its inputs. So we could have a Smi phi as input to the |
| 13 | + current phi which gets untagged and retagged to a non-Smi, all |
| 14 | + while the current phi doesn't get untagged. |
| 15 | + |
| 16 | +(cherry picked from commit a54bf5cd45e5b119e2afe6019428e81c3d626fb3) |
| 17 | + |
| 18 | +Change-Id: I9b3a2ea339f2c9d81dbb74a44425ba55d8c73871 |
| 19 | +Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7604255 |
| 20 | +Auto-Submit: Darius Mercadier <dmercadier@chromium.org> |
| 21 | +Reviewed-by: Leszek Swirski <leszeks@chromium.org> |
| 22 | +Commit-Queue: Darius Mercadier <dmercadier@chromium.org> |
| 23 | +Cr-Original-Commit-Position: refs/heads/main@{#105444} |
| 24 | +Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7659106 |
| 25 | +Auto-Submit: Srinivas Sista <srinivassista@chromium.org> |
| 26 | +Reviewed-by: Rezvan Mahdavi Hezaveh <rezvan@chromium.org> |
| 27 | +Commit-Queue: Srinivas Sista <srinivassista@chromium.org> |
| 28 | +Reviewed-by: Deepti Gandluri <gdeepti@chromium.org> |
| 29 | +Owners-Override: Srinivas Sista <srinivassista@chromium.org> |
| 30 | +Cr-Commit-Position: refs/branch-heads/14.4@{#64} |
| 31 | +Cr-Branched-From: 80acc26727d5a34e77dabeebe7c9213ec1bd4768-refs/heads/14.4.258@{#1} |
| 32 | +Cr-Branched-From: ce7e597e90f6df3fa4b6df224bc613b80c635450-refs/heads/main@{#104020} |
| 33 | + |
| 34 | +diff --git a/src/maglev/maglev-graph-builder.cc b/src/maglev/maglev-graph-builder.cc |
| 35 | +index e334c256779f224d66e2ec3c9bac2ecd88f6708f..e93c52ee51f3e80ce24af622f74ae3635446f6e9 100644 |
| 36 | +--- a/src/maglev/maglev-graph-builder.cc |
| 37 | ++++ b/src/maglev/maglev-graph-builder.cc |
| 38 | +@@ -4458,7 +4458,11 @@ bool MaglevGraphBuilder::CanElideWriteBarrier(ValueNode* object, |
| 39 | + ValueNode* value) { |
| 40 | + if (value->Is<RootConstant>() || value->Is<ConsStringMap>()) return true; |
| 41 | + if (!IsEmptyNodeType(GetType(value)) && CheckType(value, NodeType::kSmi)) { |
| 42 | +- value->MaybeRecordUseReprHint(UseRepresentation::kTagged); |
| 43 | ++ if constexpr (SmiValuesAre31Bits()) { |
| 44 | ++ if (Phi* value_as_phi = value->TryCast<Phi>()) { |
| 45 | ++ value_as_phi->SetUseRequires31BitValue(); |
| 46 | ++ } |
| 47 | ++ } |
| 48 | + return true; |
| 49 | + } |
| 50 | + |
0 commit comments