From 1113057e3e1aa4c3618bc952d5a580cd38d54fa3 Mon Sep 17 00:00:00 2001 From: Qifan Pan Date: Fri, 11 Nov 2022 15:03:27 +0100 Subject: [PATCH] [turbofan] Fix ReduceWord64Xor This CL fixes the bug where x ^ x is reduced to Int32Constant(0) for both word32 and word64. Bug: chromium:1383362, v8:9407 Change-Id: I8a2ed879f0626071f560cc5ba8c21ef2d4107e62 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4020424 Reviewed-by: Nico Hartmann Commit-Queue: Qifan Pan Cr-Commit-Position: refs/heads/main@{#84218} --- src/compiler/machine-operator-reducer.cc | 2 +- test/mjsunit/regress/regress-1383362.js | 17 +++++++++++++++++ 2 files changed, 18 insertions(+), 1 deletion(-) create mode 100644 test/mjsunit/regress/regress-1383362.js diff --git a/src/compiler/machine-operator-reducer.cc b/src/compiler/machine-operator-reducer.cc index 7514f724ce..c5ba9cbdc4 100644 --- a/src/compiler/machine-operator-reducer.cc +++ b/src/compiler/machine-operator-reducer.cc @@ -2128,7 +2128,7 @@ Reduction MachineOperatorReducer::ReduceWordNXor(Node* node) { if (m.IsFoldable()) { // K ^ K => K (K stands for arbitrary constants) return a.ReplaceIntN(m.left().ResolvedValue() ^ m.right().ResolvedValue()); } - if (m.LeftEqualsRight()) return ReplaceInt32(0); // x ^ x => 0 + if (m.LeftEqualsRight()) return Replace(a.IntNConstant(0)); // x ^ x => 0 if (A::IsWordNXor(m.left()) && m.right().Is(-1)) { typename A::IntNBinopMatcher mleft(m.left().node()); if (mleft.right().Is(-1)) { // (x ^ -1) ^ -1 => x diff --git a/test/mjsunit/regress/regress-1383362.js b/test/mjsunit/regress/regress-1383362.js new file mode 100644 index 0000000000..7237aee34c --- /dev/null +++ b/test/mjsunit/regress/regress-1383362.js @@ -0,0 +1,17 @@ +// Copyright 2022 the V8 project authors. All rights reserved. +// Use of this source code is governed by a BSD-style license that can be +// found in the LICENSE file. + +// Flags: --allow-natives-syntax + +function f(x) { + for (let i = 0; i < 1; ++i) { + x ^= x; + } + return x; +} + +%PrepareFunctionForOptimization(f); +f(1n); +%OptimizeFunctionOnNextCall(f); +f(1n);