AuroraMiddleware/v8
1
0
Fork 0
Code Issues 2 Pull Requests Releases Wiki Activity

[turbofan] Revert invalid optimization of flooring division.

Browse Source 
The optimization

  NumberFloor(NumberDivide(lhs, rhs))

to

  NumberToInt32(NumberDivide(lhs, rhs))

for potentially negative lhs is not valid, since Math.floor rounds
towards -infinity, whereas ToInt32 truncates.

BUG=chromium:699282
R=jarin@chromium.org

Review-Url: https://codereview.chromium.org/2743673002
Cr-Commit-Position: refs/heads/master@{#43699}
This commit is contained in:
bmeurer 2017-03-09 05:41:39 -08:00 committed by Commit bot
parent 0ca72de24c
commit 18be5d7057
2 changed files with 11 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
src/compiler/typed-optimization.cc
View File

@ -219,11 +219,6 @@ Reduction TypedOptimization::ReduceNumberFloor(Node* node) {
NodeProperties::SetType(node, lhs_type);
return Changed(node);
}
if (lhs_type->Is(Type::Signed32()) && rhs_type->Is(Type::Unsigned32())) {
NodeProperties::ChangeOp(node, simplified()->NumberToInt32());
NodeProperties::SetType(node, lhs_type);
return Changed(node);
}
}
return NoChange();
}

11
test/mjsunit/regress/regress-crbug-699282.js Normal file
View File

@ -0,0 +1,11 @@
// Copyright 2017 the V8 project authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
// Flags: --allow-natives-syntax
var v = 1;
function foo() { return Math.floor(-v / 125); }
assertEquals(-1, foo());
%OptimizeFunctionOnNextCall(foo);
assertEquals(-1, foo());