AuroraMiddleware/v8
1
0
Fork 0
Code Issues 2 Pull Requests Releases Wiki Activity

[turbofan] Fix simplified lowering of SpeculativeNumberModulus

Browse Source 
If the inputs are Unsigned32OrMinusZeroOrNaN and we want to compile for
an Unsigned32 result, we still need to deopt if the RHS is zero (because
that must produce NaN).

Bug: chromium:1028862
Change-Id: Ib5b7cd10f8c4ec9a76b75a2b408729f1ca86ea3e
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1943150
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Reviewed-by: Michael Stanton <mvstanton@chromium.org>
Auto-Submit: Georg Neis <neis@chromium.org>
Commit-Queue: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#65260}
This commit is contained in:
Georg Neis 2019-11-29 11:08:11 +01:00 committed by Commit Bot
parent 21ad38ef83
commit 3363ddd4b9
2 changed files with 19 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
src/compiler/simplified-lowering.cc
View File

@ -1565,7 +1565,7 @@ class RepresentationSelector {
} else if (BothInputsAre(node, Type::Unsigned32OrMinusZeroOrNaN())) {
VisitBinop(node, lhs_use, rhs_use, MachineRepresentation::kWord32,
Type::Unsigned32());
if (lower()) DeferReplacement(node, lowering->Uint32Mod(node));
if (lower()) ChangeToUint32OverflowOp(node);
} else {
VisitBinop(node, lhs_use, rhs_use, MachineRepresentation::kWord32,
Type::Signed32());

18
test/mjsunit/compiler/regress-1028862.js Normal file
View File

@ -0,0 +1,18 @@
// Copyright 2019 the V8 project authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
// Flags: --allow-natives-syntax
function foo() {
for (let i = 0; i < 5; i++) {
// Only allocate feedback vector after the first round so that we get Smi
// feedback for the modulus operation.
if (i == 1) %PrepareFunctionForOptimization(foo);
1 == new Date(42).getMilliseconds() % i;
}
}
foo();
%OptimizeFunctionOnNextCall(foo);
foo();