AuroraMiddleware/v8
1
0
Fork 0
Code Issues 2 Pull Requests Releases Wiki Activity

[crankshaft] do not sign-extend int32 immediate in DoMathMinMax.

Browse Source 
R=bmeurer@chromium.org
BUG=chromium:495493

Review-Url: https://codereview.chromium.org/2044353002
Cr-Commit-Position: refs/heads/master@{#36818}
This commit is contained in:
yangguo 2016-06-08 03:10:01 -07:00 committed by Commit bot
parent 520a214b88
commit 7c3cad2d14
2 changed files with 13 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
src/crankshaft/x64/lithium-codegen-x64.cc
View File

@ -1779,7 +1779,7 @@ void LCodeGen::DoMathMinMax(LMathMinMax* instr) {
: SmiValuesAre31Bits());
__ cmpl(left_reg, right_imm);
__ j(condition, &return_left, Label::kNear);
__ movp(left_reg, right_imm);
__ movl(left_reg, right_imm);
} else if (right->IsRegister()) {
Register right_reg = ToRegister(right);
if (instr->hydrogen_value()->representation().IsSmi()) {

12
test/mjsunit/regress/regress-crbug-495493.js Normal file
View File

@ -0,0 +1,12 @@
// Copyright 2016 the V8 project authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
// Flags: --nofold-constants --enable-slow-asserts --debug-code
function foo(p) {
for (var i = 0; i < 100000; ++i) {
p = Math.min(-1, 0);
}
}
foo(0);