AuroraMiddleware/v8
1
0
Fork 0
Code Issues 2 Pull Requests Releases Wiki Activity

Restrict representation inference to avoid truncation of phi inputs.

Browse Source 
BUG=chromium:446778
LOG=N

Review URL: https://codereview.chromium.org/837153002

Cr-Commit-Position: refs/heads/master@{#25967}
This commit is contained in:
jarin 2015-01-07 03:38:42 -08:00 committed by Commit bot
parent c71239dc10
commit 80a7be5cd9
3 changed files with 22 additions and 9 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
src/compiler/simplified-lowering.cc
View File

@ -307,8 +307,8 @@ class RepresentationSelector {
if ((use & kRepMask) == kRepTagged) {
// only tagged uses.
return kRepTagged;
} else if (IsSafeIntAdditiveOperand(node)) {
// Integer within [-2^52, 2^52] range.
} else if (upper->Is(Type::Integral32())) {
// Integer within [-2^31, 2^32[ range.
if ((use & kRepMask) == kRepFloat64) {
// only float64 uses.
return kRepFloat64;
@ -318,7 +318,7 @@ class RepresentationSelector {
} else if ((use & kRepMask) == kRepWord32 ||
(use & kTypeMask) == kTypeInt32 ||
(use & kTypeMask) == kTypeUint32) {
// The type is a safe integer, but we only use 32 bits.
// We only use 32 bits or we use the result consistently.
return kRepWord32;
} else {
return kRepFloat64;

8
test/cctest/compiler/test-simplified-lowering.cc
View File

@ -2037,11 +2037,6 @@ TEST(PhiRepresentation) {
HandleAndZoneScope scope;
Zone* z = scope.main_zone();
Factory* f = z->isolate()->factory();
Handle<Object> range_min = f->NewNumber(-1e13);
Handle<Object> range_max = f->NewNumber(1e+15);
Type* range = Type::Range(range_min, range_max, z);
struct TestData {
Type* arg1;
Type* arg2;
@ -2052,7 +2047,8 @@ TEST(PhiRepresentation) {
TestData test_data[] = {
{Type::Signed32(), Type::Unsigned32(), kMachInt32,
kRepWord32 | kTypeNumber},
{range, range, kMachUint32, kRepWord32 | kTypeNumber},
{Type::Signed32(), Type::Unsigned32(), kMachUint32,
kRepWord32 | kTypeNumber},
{Type::Signed32(), Type::Signed32(), kMachInt32, kMachInt32},
{Type::Unsigned32(), Type::Unsigned32(), kMachInt32, kMachUint32},
{Type::Number(), Type::Signed32(), kMachInt32, kMachFloat64},

17
test/mjsunit/compiler/regress-446778.js Normal file
View File

@ -0,0 +1,17 @@
// Copyright 2015 the V8 project authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
function Module() {
"use asm";
function f() {
var i = (140737463189505);
do {
i = i + i | 0;
x = undefined + i | 0;
} while (!i);
}
return { f: f };
}
Module().f();