AuroraMiddleware/v8
1
0
Fork 0
Code Issues 2 Pull Requests Releases Wiki Activity

[turbofan] Fix invalid Number.parseInt inlining.

Browse Source 
The inlined version of Number.parseInt did a ToInt32 truncation, which
is not what the EcmaScript specification says.

R=jarin@chromium.org
BUG=v8:5538

Review-Url: https://chromiumcodereview.appspot.com/2432143002
Cr-Commit-Position: refs/heads/master@{#40418}
This commit is contained in:
bmeurer 2016-10-18 22:17:31 -07:00 committed by Commit bot
parent dce6ebad07
commit 3a7eac15e8
3 changed files with 59 additions and 7 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
src/compiler/js-builtin-reducer.cc
View File

@ -887,11 +887,10 @@ Reduction JSBuiltinReducer::ReduceNumberParseInt(Node* node) {
r.InputsMatchTwo(type_cache_.kSafeInteger,
type_cache_.kZeroOrUndefined) ||
r.InputsMatchTwo(type_cache_.kSafeInteger, type_cache_.kTenOrUndefined)) {
// Number.parseInt(a:safe-integer) -> NumberToInt32(a)
// Number.parseInt(a:safe-integer,b:#0\/undefined) -> NumberToInt32(a)
// Number.parseInt(a:safe-integer,b:#10\/undefined) -> NumberToInt32(a)
Node* input = r.GetJSCallInput(0);
Node* value = graph()->NewNode(simplified()->NumberToInt32(), input);
// Number.parseInt(a:safe-integer) -> a
// Number.parseInt(a:safe-integer,b:#0\/undefined) -> a
// Number.parseInt(a:safe-integer,b:#10\/undefined) -> a
Node* value = r.GetJSCallInput(0);
return Replace(value);
}
return NoChange();

53
test/mjsunit/compiler/regress-5538.js Normal file
View File

@ -0,0 +1,53 @@
// Copyright 2016 the V8 project authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
// Flags: --allow-natives-syntax
(function() {
function foo(x) {
x = x | 0;
return Number.parseInt(x + 1);
}
assertEquals(1, foo(0));
assertEquals(2, foo(1));
%OptimizeFunctionOnNextCall(foo);
assertEquals(Math.pow(2, 31), foo(Math.pow(2, 31) - 1));
})();
(function() {
function foo(x) {
x = x | 0;
return Number.parseInt(x + 1, 0);
}
assertEquals(1, foo(0));
assertEquals(2, foo(1));
%OptimizeFunctionOnNextCall(foo);
assertEquals(Math.pow(2, 31), foo(Math.pow(2, 31) - 1));
})();
(function() {
function foo(x) {
x = x | 0;
return Number.parseInt(x + 1, 10);
}
assertEquals(1, foo(0));
assertEquals(2, foo(1));
%OptimizeFunctionOnNextCall(foo);
assertEquals(Math.pow(2, 31), foo(Math.pow(2, 31) - 1));
})();
(function() {
function foo(x) {
x = x | 0;
return Number.parseInt(x + 1, undefined);
}
assertEquals(1, foo(0));
assertEquals(2, foo(1));
%OptimizeFunctionOnNextCall(foo);
assertEquals(Math.pow(2, 31), foo(Math.pow(2, 31) - 1));
})();

4
test/unittests/compiler/js-builtin-reducer-unittest.cc
View File

@ -1517,7 +1517,7 @@ TEST_F(JSBuiltinReducerTest, NumberParseIntWithIntegral32) {
Reduction r = Reduce(call);
ASSERT_TRUE(r.Changed());
EXPECT_THAT(r.replacement(), IsNumberToInt32(p0));
EXPECT_EQ(p0, r.replacement());
}
}
@ -1537,7 +1537,7 @@ TEST_F(JSBuiltinReducerTest, NumberParseIntWithIntegral32AndUndefined) {
Reduction r = Reduce(call);
ASSERT_TRUE(r.Changed());
EXPECT_THAT(r.replacement(), IsNumberToInt32(p0));
EXPECT_EQ(p0, r.replacement());
}
}