AuroraMiddleware/v8
1
0
Fork 0
Code Issues 2 Pull Requests Releases Wiki Activity

[compiler] Fix a monotonicity issue in SimplifiedLowering

Browse Source 
Bug: chromium:1202924
Change-Id: I555fc44c52a3883010e1c643a41d470fcc683a6a
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2851880
Auto-Submit: Georg Neis <neis@chromium.org>
Commit-Queue: Nico Hartmann <nicohartmann@chromium.org>
Reviewed-by: Nico Hartmann <nicohartmann@chromium.org>
Cr-Commit-Position: refs/heads/master@{#74201}
This commit is contained in:
Georg Neis 2021-04-27 08:53:03 +02:00 committed by Commit Bot
parent 707c5a0b38
commit 31813c7de6
2 changed files with 19 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
src/compiler/simplified-lowering.cc
View File

@ -218,7 +218,7 @@ bool CanOverflowSigned32(const Operator* op, Type left, Type right,
}
bool IsSomePositiveOrderedNumber(Type type) {
return type.Is(Type::OrderedNumber()) && !type.IsNone() && type.Min() > 0;
return type.Is(Type::OrderedNumber()) && (type.IsNone() || type.Min() > 0);
}
} // namespace

18
test/mjsunit/compiler/regress-1202924.js Normal file
View File

@ -0,0 +1,18 @@
// Copyright 2021 the V8 project authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
// Flags: --no-lazy-feedback-allocation --interrupt-budget=1000
// Flags: --no-analyze-environment-liveness
function foo() {
for (var i = 1; i < 10; i++) {
var n = 1;
for (var j = 1; j < 10; j++) {
if (n == j) j = 0;
foo = j % - n;
n++;
}
}
}
foo();