AuroraMiddleware/v8
1
0
Fork 0
Code Issues 2 Pull Requests Releases Wiki Activity

[turbofan] fix deopt-loop for specuative Boolean to Number conversion

Browse Source 
Bug: chromium:965513
Change-Id: I18ff91c98ad6106c5d4df260e6ead6a9e2425dbb
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1622119
Commit-Queue: Tobias Tebbi <tebbi@chromium.org>
Auto-Submit: Tobias Tebbi <tebbi@chromium.org>
Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#61730}
This commit is contained in:
Tobias Tebbi 2019-05-21 17:34:13 +02:00 committed by Commit Bot
parent 9188d54941
commit 52636535fa
3 changed files with 23 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
src/compiler/representation-change.cc
View File

@ -843,7 +843,10 @@ Node* RepresentationChanger::GetFloat64RepresentationFor(
}
} else if (output_rep == MachineRepresentation::kBit) {
CHECK(output_type.Is(Type::Boolean()));
if (use_info.truncation().IsUsedAsFloat64()) {
// TODO(tebbi): TypeCheckKind::kNumberOrOddball should imply Float64
// truncation, since this exactly means that we treat Oddballs as Numbers.
if (use_info.truncation().IsUsedAsFloat64() ||
use_info.type_check() == TypeCheckKind::kNumberOrOddball) {
op = machine()->ChangeUint32ToFloat64();
} else {
CHECK_NE(use_info.type_check(), TypeCheckKind::kNone);
@ -975,6 +978,7 @@ Node* RepresentationChanger::GetWord32RepresentationFor(
CHECK(Truncation::Any(kIdentifyZeros)
.IsLessGeneralThan(use_info.truncation()));
CHECK_NE(use_info.type_check(), TypeCheckKind::kNone);
CHECK_NE(use_info.type_check(), TypeCheckKind::kNumberOrOddball);
Node* unreachable =
InsertUnconditionalDeopt(use_node, DeoptimizeReason::kNotASmi);
return jsgraph()->graph()->NewNode(
@ -1261,6 +1265,7 @@ Node* RepresentationChanger::GetWord64RepresentationFor(
} else if (output_rep == MachineRepresentation::kBit) {
CHECK(output_type.Is(Type::Boolean()));
CHECK_NE(use_info.type_check(), TypeCheckKind::kNone);
CHECK_NE(use_info.type_check(), TypeCheckKind::kNumberOrOddball);
Node* unreachable =
InsertUnconditionalDeopt(use_node, DeoptimizeReason::kNotASmi);
return jsgraph()->graph()->NewNode(

2
src/compiler/representation-change.h
View File

@ -240,6 +240,8 @@ class UseInfo {
}
static UseInfo CheckedNumberOrOddballAsFloat64(
IdentifyZeros identify_zeros, const VectorSlotPair& feedback) {
// TODO(tebbi): We should use Float64 truncation here, since this exactly
// means that we treat Oddballs as Numbers.
return UseInfo(MachineRepresentation::kFloat64,
Truncation::Any(identify_zeros),
TypeCheckKind::kNumberOrOddball, feedback);

15
test/mjsunit/compiler/regress-crbug-965513.js Normal file
View File

@ -0,0 +1,15 @@
// Copyright 2019 the V8 project authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
// Flags: --allow-natives-syntax --opt
%EnsureFeedbackVectorForFunction(foo);
function foo(x) {
return x * (x == 1);
}
foo(0.5);
foo(1.5);
%OptimizeFunctionOnNextCall(foo);
foo(1.5);
assertOptimized(foo);