AuroraMiddleware/v8
1
0
Fork 0
Code Issues 2 Pull Requests Releases Wiki Activity

[turbofan] Fix deoptimization of boolean bit constants.

Browse Source 
BUG=chromium:664490

Review-Url: https://codereview.chromium.org/2495243002
Cr-Commit-Position: refs/heads/master@{#40951}
This commit is contained in:
jarin 2016-11-14 01:30:07 -08:00 committed by Commit bot
parent 942604dfb2
commit 297a969aad
3 changed files with 27 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
src/compiler/code-generator.cc
View File

@ -858,12 +858,18 @@ void CodeGenerator::AddTranslationForOperand(Translation* translation,
constant_object =
handle(reinterpret_cast<Smi*>(constant.ToInt32()), isolate());
DCHECK(constant_object->IsSmi());
} else if (type.representation() == MachineRepresentation::kBit) {
if (constant.ToInt32() == 0) {
constant_object = isolate()->factory()->false_value();
} else {
DCHECK_EQ(1, constant.ToInt32());
constant_object = isolate()->factory()->true_value();
}
} else {
// TODO(jarin,bmeurer): We currently pass in raw pointers to the
// JSFunction::entry here. We should really consider fixing this.
DCHECK(type == MachineType::Int32() ||
type == MachineType::Uint32() ||
type.representation() == MachineRepresentation::kBit ||
type.representation() == MachineRepresentation::kWord32 ||
type.representation() == MachineRepresentation::kNone);
DCHECK(type.representation() != MachineRepresentation::kNone ||

2
src/compiler/simplified-lowering.cc
View File

@ -1030,6 +1030,8 @@ class RepresentationSelector {
MachineRepresentation::kWord32 ||
machine_type.semantic() == MachineSemantic::kInt32 ||
machine_type.semantic() == MachineSemantic::kUint32);
DCHECK(machine_type.representation() != MachineRepresentation::kBit ||
input_type->Is(Type::Boolean()));
(*types)[i] = machine_type;
}
}

18
test/mjsunit/compiler/regress-664490.js Normal file
View File

@ -0,0 +1,18 @@
// Copyright 2016 the V8 project authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
// Flags: --allow-natives-syntax
var foo = function(msg) {};
foo = function (value) {
assertEquals(false, value);
}
function f() {
foo(undefined == 0);
}
%OptimizeFunctionOnNextCall(f);
f();