[compiler] Don't inline Array.prototype.sort on mixed elements kinds [v8/v8 : main]
22 views
Skip to first unread message
Jakob Linke (Gerrit)
Aug 7, 2026, 2:53:11 AMAug 7
to Darius Mercadier, chrom...@appspot.gserviceaccount.com, v8-s...@luci-project-accounts.iam.gserviceaccount.com, dmercadi...@chromium.org, leszek...@chromium.org, v8-re...@googlegroups.com, verwaes...@chromium.org, victorgo...@chromium.org
Attention needed from Darius Mercadier
Jakob Linke voted Auto-Submit+1![]( "Open in Gerrit")
| Auto-Submit | +1 |
Related details
Attention is currently required from:
- Darius Mercadier
Submit Requirements:
Code-Owners
Code-Review
Review-Enforcement
| Inspect html for hidden footers to help with email filtering. To unsubscribe visit settings. |
Darius Mercadier (Gerrit)
Aug 7, 2026, 3:09:10 AMAug 7
to Jakob Linke, chrom...@appspot.gserviceaccount.com, v8-s...@luci-project-accounts.iam.gserviceaccount.com, dmercadi...@chromium.org, leszek...@chromium.org, v8-re...@googlegroups.com, verwaes...@chromium.org, victorgo...@chromium.org
Attention needed from Jakob Linke
Darius Mercadier voted and added 1 comment![]( "Open in Gerrit")
Votes added by Darius Mercadier
| Code-Review | +1 |
| Commit-Queue | +2 |
1 comment
Patchset-level comments
Related details
Attention is currently required from:
- Jakob Linke
Submit Requirements:
Code-Owners
Code-Review
Review-Enforcement
| Inspect html for hidden footers to help with email filtering. To unsubscribe visit settings. |
v8-scoped@luci-project-accounts.iam.gserviceaccount.com (Gerrit)
Aug 7, 2026, 4:23:52 AMAug 7
to Jakob Linke, Darius Mercadier, chrom...@appspot.gserviceaccount.com, dmercadi...@chromium.org, leszek...@chromium.org, v8-re...@googlegroups.com, verwaes...@chromium.org, victorgo...@chromium.org
v8-s...@luci-project-accounts.iam.gserviceaccount.com submitted the change![]( "Open in Gerrit")
Change information
Commit message:
[compiler] Don't inline Array.prototype.sort on mixed elements kinds
CanInlineArrayIteratingBuiltin unions the receiver elements kinds, so
polymorphic feedback yields a kind that no single receiver need have:
{PACKED_SMI,PACKED} unions to PACKED_ELEMENTS. That is fine for the
iterating builtins, which only read the receiver, but the inlined sort
snapshots the elements, runs comparefn, and copies the snapshot back
specialized on the union kind.
A comparefn can narrow the live receiver to another kind in the map set
(a.fill(0) turns PACKED_ELEMENTS into PACKED_SMI_ELEMENTS). The
post-callback check accepts that map because it is in the original set,
and the copy-back then stores the snapshotted HeapObjects into a
Smi-elements array. Smi consumers of the resulting array read those
HeapObjects as Smis and move them without write barriers.
Require all receiver maps to agree on their elements kind before
inlining, in both Maglev and Turbofan. Monomorphic feedback is
unaffected, as is polymorphism whose maps share an elements kind; sites
with mixed kinds fall back to the generic builtin.
Fixed: 542403045
Change-Id: I38d9d3efc5942bd0122bbbe48bc26417a080821f
Auto-Submit: Jakob Linke <jgr...@chromium.org>
Commit-Queue: Darius Mercadier <dmerc...@chromium.org>
Commit-Queue: Jakob Linke <jgr...@chromium.org>
Reviewed-by: Darius Mercadier <dmerc...@chromium.org>
Cr-Commit-Position: refs/heads/main@{#109116}
Files:
- M src/compiler/js-call-reducer.cc
- M src/maglev/maglev-graph-builder.cc
- A test/mjsunit/regress/regress-crbug-542403045.js
Change size: M
Delta: 3 files changed, 111 insertions(+), 0 deletions(-)
Branch: refs/heads/main
Submit Requirements:
Code-Review: +1 by Darius Mercadier
| Inspect html for hidden footers to help with email filtering. To unsubscribe visit settings. |
Reply all
Reply to author
Forward
0 new messages