AuroraMiddleware/v8
1
0
Fork 0
Code Issues 2 Pull Requests Releases Wiki Activity

[turbofan] Handle Smi -> Float32 conversion in representation changer.

Browse Source 
BUG=chromium:693425

Review-Url: https://codereview.chromium.org/2749193003
Cr-Commit-Position: refs/heads/master@{#43811}
This commit is contained in:
jarin 2017-03-15 00:44:59 -07:00 committed by Commit bot
parent be6b9f9204
commit 8c114d1737
2 changed files with 12 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
src/compiler/representation-change.cc
View File

@ -498,8 +498,7 @@ Node* RepresentationChanger::GetFloat32RepresentationFor(
node = jsgraph()->graph()->NewNode(op, node); node = jsgraph()->graph()->NewNode(op, node);
op = machine()->TruncateFloat64ToFloat32(); op = machine()->TruncateFloat64ToFloat32();
} }
} else if (output_rep == MachineRepresentation::kTagged || } else if (IsAnyTagged(output_rep)) {
output_rep == MachineRepresentation::kTaggedPointer) {
if (output_type->Is(Type::NumberOrOddball())) { if (output_type->Is(Type::NumberOrOddball())) {
// tagged -> float64 -> float32 // tagged -> float64 -> float32
if (output_type->Is(Type::Number())) { if (output_type->Is(Type::Number())) {

11
test/mjsunit/compiler/regress-693425.js Normal file
View File

@ -0,0 +1,11 @@
// Copyright 2017 the V8 project authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
var g = 0;
g++;
var f32 = new Float32Array();
function foo() {
f32[0 >> 2] = g;
}
foo();