AuroraMiddleware/v8
1
0
Fork 0
Code Issues 2 Pull Requests Releases Wiki Activity

[turbofan] Don't propagate truncations if output is tagged.

Browse Source 
Disable the propagation of truncations through Phi, Select or TypeGuard
if the output representation is tagged, because when the truncations are
taken we don't necessarily reflect this in the types and therefore we
might end up in a situation where we produce a word32 value, the type
says Number, and now we need to change that to tagged, which is not
possible since we don't know how to interpret the bits, i.e. whether the
value is Signed32 or Unsigned32.

BUG=chromium:644048

Review-Url: https://codereview.chromium.org/2311903002
Cr-Commit-Position: refs/heads/master@{#39186}
This commit is contained in:
mvstanton 2016-09-05 13:54:27 -07:00 committed by Commit bot
parent 7f53dac6d9
commit 8af781ea82
2 changed files with 25 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
src/compiler/simplified-lowering.cc
View File

@ -912,6 +912,9 @@ class RepresentationSelector {
}
// Convert inputs to the output representation of this phi, pass the
// truncation truncation along.
if (output == MachineRepresentation::kTagged) {
truncation = Truncation::Any();
}
UseInfo input_use(output, truncation);
ProcessInput(node, 1, input_use);
ProcessInput(node, 2, input_use);
@ -936,6 +939,9 @@ class RepresentationSelector {
// Convert inputs to the output representation of this phi, pass the
// truncation along.
if (output == MachineRepresentation::kTagged) {
truncation = Truncation::Any();
}
UseInfo input_use(output, truncation);
for (int i = 0; i < node->InputCount(); i++) {
ProcessInput(node, i, i < values ? input_use : UseInfo::None());
@ -2415,6 +2421,9 @@ class RepresentationSelector {
MachineRepresentation output =
GetOutputInfoForPhi(node, TypeOf(node->InputAt(0)), truncation);
if (output == MachineRepresentation::kTagged) {
truncation = Truncation::Any();
}
VisitUnop(node, UseInfo(output, truncation), output);
if (lower()) DeferReplacement(node, node->InputAt(0));
return;

16
test/mjsunit/compiler/regress-644048.js Normal file
View File

@ -0,0 +1,16 @@
// Copyright 2016 the V8 project authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
// Flags: --allow-natives-syntax
function foo(x) {
(x
? (!0 / 0)
: x) | 0
}
foo(1);
foo(2);
%OptimizeFunctionOnNextCall(foo);
foo(3);