AuroraMiddleware/v8
1
0
Fork 0
Code Issues 2 Pull Requests Releases Wiki Activity

Reland "[turbofan] Fix bug in Number.Min/Max typings"

Browse Source 
This reverts commit f442b03fe2.

Reason for reland: Wrongly reverted.

Original change's description:
> Revert "[turbofan] Fix bug in Number.Min/Max typings"
> 
> This reverts commit 4158af83db.
> 
> Reason for revert: causing UBSAN failures:
> 
> https://ci.chromium.org/p/v8/builders/ci/V8%20Linux64%20UBSan/10729?
> 
> 
> Original change's description:
> > [turbofan] Fix bug in Number.Min/Max typings
> > 
> > They try to be very precise about when the result can be -0,
> > but do so incorrectly. I'm changing the code to just do the
> > simple thing instead. Let's see how that affects performance.
> > 
> > Bug: chromium:1072171
> > Change-Id: I9737a84aa19d06685af5b7bca541e348dc37cca8
> > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2157028
> > Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
> > Commit-Queue: Georg Neis <neis@chromium.org>
> > Cr-Commit-Position: refs/heads/master@{#67246}
> 
> TBR=neis@chromium.org,tebbi@chromium.org
> 
> Change-Id: I0d9b312e27f5a8bbbebeccdc9819fa94f10af139
> No-Presubmit: true
> No-Tree-Checks: true
> No-Try: true
> Bug: chromium:1072171
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2157646
> Reviewed-by: Francis McCabe <fgm@chromium.org>
> Commit-Queue: Francis McCabe <fgm@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#67249}

TBR=neis@chromium.org,tebbi@chromium.org,fgm@chromium.org

Change-Id: Ida36ca584a5af5da887189328c8da195b26285d4
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: chromium:1072171
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2157368
Reviewed-by: Georg Neis <neis@chromium.org>
Commit-Queue: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67263}
This commit is contained in:
Georg Neis 2020-04-21 07:45:09 +00:00 committed by Commit Bot
parent 58ac66b7a3
commit 898b8915b0
3 changed files with 51 additions and 17 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

21
src/compiler/operation-typer.cc
View File

@ -1040,32 +1040,26 @@ Type OperationTyper::NumberMax(Type lhs, Type rhs) {
if (lhs.Maybe(Type::NaN()) || rhs.Maybe(Type::NaN())) {
type = Type::Union(type, Type::NaN(), zone());
}
if (lhs.Maybe(Type::MinusZero()) || rhs.Maybe(Type::MinusZero())) {
type = Type::Union(type, Type::MinusZero(), zone());
}
if (!lhs.Is(cache_->kIntegerOrMinusZeroOrNaN) ||
!rhs.Is(cache_->kIntegerOrMinusZeroOrNaN)) {
return Type::Union(type, Type::Union(lhs, rhs, zone()), zone());
}
bool const lhs_maybe_minus_zero = lhs.Maybe(Type::MinusZero());
bool const rhs_maybe_minus_zero = rhs.Maybe(Type::MinusZero());
lhs = Type::Intersect(lhs, cache_->kInteger, zone());
rhs = Type::Intersect(rhs, cache_->kInteger, zone());
bool maybe_minus_zero = lhs_maybe_minus_zero || rhs_maybe_minus_zero;
if (!lhs.IsNone() || !rhs.IsNone()) {
double min = std::max(lhs.IsNone() ? -V8_INFINITY : lhs.Min(),
rhs.IsNone() ? -V8_INFINITY : rhs.Min());
double max = std::max(lhs.IsNone() ? -V8_INFINITY : lhs.Max(),
rhs.IsNone() ? -V8_INFINITY : rhs.Max());
type = Type::Union(type, Type::Range(min, max, zone()), zone());
maybe_minus_zero =
maybe_minus_zero && (min < 0.0 || (min == 0.0 && lhs_maybe_minus_zero &&
rhs_maybe_minus_zero));
}
if (maybe_minus_zero) {
type = Type::Union(type, Type::MinusZero(), zone());
}
return type;
}
@ -1080,14 +1074,15 @@ Type OperationTyper::NumberMin(Type lhs, Type rhs) {
if (lhs.Maybe(Type::NaN()) || rhs.Maybe(Type::NaN())) {
type = Type::Union(type, Type::NaN(), zone());
}
if (lhs.Maybe(Type::MinusZero()) || rhs.Maybe(Type::MinusZero())) {
type = Type::Union(type, Type::MinusZero(), zone());
}
if (!lhs.Is(cache_->kIntegerOrMinusZeroOrNaN) ||
!rhs.Is(cache_->kIntegerOrMinusZeroOrNaN)) {
return Type::Union(type, Type::Union(lhs, rhs, zone()), zone());
}
bool maybe_minus_zero =
lhs.Maybe(Type::MinusZero()) || rhs.Maybe(Type::MinusZero());
lhs = Type::Intersect(lhs, cache_->kInteger, zone());
rhs = Type::Intersect(rhs, cache_->kInteger, zone());
@ -1097,12 +1092,8 @@ Type OperationTyper::NumberMin(Type lhs, Type rhs) {
double max = std::min(lhs.IsNone() ? +V8_INFINITY : lhs.Max(),
rhs.IsNone() ? +V8_INFINITY : rhs.Max());
type = Type::Union(type, Type::Range(min, max, zone()), zone());
maybe_minus_zero = maybe_minus_zero && max >= 0.0;
}
if (maybe_minus_zero) {
type = Type::Union(type, Type::MinusZero(), zone());
}
return type;
}

45
test/mjsunit/compiler/regress-1072171.js Normal file
View File

@ -0,0 +1,45 @@
// Copyright 2020 the V8 project authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
// Flags: --allow-natives-syntax
function testMax1(b) {
const max = Math.max(-1, b ? -0 : 1);
return Object.is(max, -0);
}
%PrepareFunctionForOptimization(testMax1);
assertTrue(testMax1(true));
assertTrue(testMax1(true));
%OptimizeFunctionOnNextCall(testMax1);
assertTrue(testMax1(true));
function testMax2(b) {
const max = Math.max(b ? -0 : 1, -1);
return Object.is(max, -0);
}
%PrepareFunctionForOptimization(testMax2);
assertTrue(testMax2(true));
assertTrue(testMax2(true));
%OptimizeFunctionOnNextCall(testMax2);
assertTrue(testMax2(true));
function testMin1(b) {
const min = Math.min(1, b ? -0 : -1);
return Object.is(min, -0);
}
%PrepareFunctionForOptimization(testMin1);
assertTrue(testMin1(true));
assertTrue(testMin1(true));
%OptimizeFunctionOnNextCall(testMin1);
assertTrue(testMin1(true));
function testMin2(b) {
const min = Math.min(b ? -0 : -1, 1);
return Object.is(min, -0);
}
%PrepareFunctionForOptimization(testMin2);
assertTrue(testMin2(true));
assertTrue(testMin2(true));
%OptimizeFunctionOnNextCall(testMin2);
assertTrue(testMin2(true));

2
test/unittests/compiler/typer-unittest.cc
View File

@ -622,12 +622,10 @@ TEST_F(TyperTest, Manual_Operation_NumberMax) {
Type f = t(Type::MinusZero(), zero);
CHECK(zero.Is(f));
CHECK(f.Is(b));
CHECK(f.Is(zero)); // Checks precision, not soundness.
Type g = t(zero, Type::MinusZero());
CHECK(zero.Is(g));
CHECK(g.Is(c));
CHECK(g.Is(zero)); // Checks precision, not soundness.
}
TEST_F(TyperTest, Manual_Operation_NumberMin) {