AuroraMiddleware/v8
1
0
Fork 0
Code Issues 2 Pull Requests Releases Wiki Activity

[turbofan] x - y < 0 is not equivalent to x < y.

Browse Source 
We cannot change x - y < 0 to x < y, because it would only be safe if
x - y cannot overflow, which we don't know in general.

R=jarin@chromium.org
BUG=v8:5129

Review-Url: https://codereview.chromium.org/2090493002
Cr-Commit-Position: refs/heads/master@{#37164}
This commit is contained in:
bmeurer 2016-06-21 22:35:24 -07:00 committed by Commit bot
parent 1006f3cd23
commit 488d6e5f84
3 changed files with 15 additions and 34 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

24
src/compiler/machine-operator-reducer.cc
View File

@ -234,18 +234,6 @@ Reduction MachineOperatorReducer::Reduce(Node* node) {
if (m.IsFoldable()) { // K < K => K
return ReplaceBool(m.left().Value() < m.right().Value());
}
if (m.left().IsInt32Sub() && m.right().Is(0)) { // x - y < 0 => x < y
Int32BinopMatcher msub(m.left().node());
node->ReplaceInput(0, msub.left().node());
node->ReplaceInput(1, msub.right().node());
return Changed(node);
}
if (m.left().Is(0) && m.right().IsInt32Sub()) { // 0 < x - y => y < x
Int32BinopMatcher msub(m.right().node());
node->ReplaceInput(0, msub.right().node());
node->ReplaceInput(1, msub.left().node());
return Changed(node);
}
if (m.LeftEqualsRight()) return ReplaceBool(false); // x < x => false
break;
}
@ -254,18 +242,6 @@ Reduction MachineOperatorReducer::Reduce(Node* node) {
if (m.IsFoldable()) { // K <= K => K
return ReplaceBool(m.left().Value() <= m.right().Value());
}
if (m.left().IsInt32Sub() && m.right().Is(0)) { // x - y <= 0 => x <= y
Int32BinopMatcher msub(m.left().node());
node->ReplaceInput(0, msub.left().node());
node->ReplaceInput(1, msub.right().node());
return Changed(node);
}
if (m.left().Is(0) && m.right().IsInt32Sub()) { // 0 <= x - y => y <= x
Int32BinopMatcher msub(m.right().node());
node->ReplaceInput(0, msub.right().node());
node->ReplaceInput(1, msub.left().node());
return Changed(node);
}
if (m.LeftEqualsRight()) return ReplaceBool(true); // x <= x => true
break;
}

10
test/cctest/compiler/test-machine-operator-reducer.cc
View File

@ -616,13 +616,8 @@ TEST(ReduceInt32LessThan) {
R.CheckDontPutConstantOnRight(-440197);
Node* x = R.Parameter(0);
Node* y = R.Parameter(1);
Node* zero = R.Constant<int32_t>(0);
Node* sub = R.graph.NewNode(R.machine.Int32Sub(), x, y);
R.CheckFoldBinop<int32_t>(0, x, x); // x < x => 0
R.CheckFoldBinop(x, y, sub, zero); // x - y < 0 => x < y
R.CheckFoldBinop(y, x, zero, sub); // 0 < x - y => y < x
}
@ -640,13 +635,8 @@ TEST(ReduceInt32LessThanOrEqual) {
FOR_INT32_INPUTS(i) { R.CheckDontPutConstantOnRight<int32_t>(*i); }
Node* x = R.Parameter(0);
Node* y = R.Parameter(1);
Node* zero = R.Constant<int32_t>(0);
Node* sub = R.graph.NewNode(R.machine.Int32Sub(), x, y);
R.CheckFoldBinop<int32_t>(1, x, x); // x <= x => 1
R.CheckFoldBinop(x, y, sub, zero); // x - y <= 0 => x <= y
R.CheckFoldBinop(y, x, zero, sub); // 0 <= x - y => y <= x
}

15
test/mjsunit/compiler/regress-5129.js Normal file
View File

@ -0,0 +1,15 @@
// Copyright 2016 the V8 project authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
// Flags: --allow-natives-syntax
function foo($a,$b) {
$a = $a|0;
$b = $b|0;
var $sub = $a - $b;
return ($sub|0) < 0;
}
%OptimizeFunctionOnNextCall(foo);
assertTrue(foo(0x7fffffff,-1));