AuroraMiddleware/v8
1
0
Fork 0
Code Issues 2 Pull Requests Releases Wiki Activity

[turbofan] Add missing Float32 -> TaggedSigned conversion.

Browse Source 
There are a couple of operators that can indeed produce Float32
representation, which we might end up using in a TaggedSigned
context, so add the missing conversion (indirectly via Float64).

BUG=chromium:656275
R=jarin@chromium.org

Review-Url: https://codereview.chromium.org/2421193002
Cr-Commit-Position: refs/heads/master@{#40334}
This commit is contained in:
bmeurer 2016-10-16 22:40:42 -07:00 committed by Commit bot
parent 5445fe66ad
commit 96f1327a93
2 changed files with 32 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

18
src/compiler/representation-change.cc
View File

@ -250,6 +250,24 @@ Node* RepresentationChanger::GetTaggedSignedRepresentationFor(
return TypeError(node, output_rep, output_type,
MachineRepresentation::kTaggedSigned);
}
} else if (output_rep == MachineRepresentation::kFloat32) {
if (use_info.type_check() == TypeCheckKind::kSignedSmall) {
op = machine()->ChangeFloat32ToFloat64();
node = InsertConversion(node, op, use_node);
op = simplified()->CheckedFloat64ToInt32(
output_type->Maybe(Type::MinusZero())
? CheckForMinusZeroMode::kCheckForMinusZero
: CheckForMinusZeroMode::kDontCheckForMinusZero);
node = InsertConversion(node, op, use_node);
if (SmiValuesAre32Bits()) {
op = simplified()->ChangeInt32ToTagged();
} else {
op = simplified()->CheckedInt32ToTaggedSigned();
}
} else {
return TypeError(node, output_rep, output_type,
MachineRepresentation::kTaggedSigned);
}
} else if (CanBeTaggedPointer(output_rep) &&
use_info.type_check() == TypeCheckKind::kSignedSmall) {
op = simplified()->CheckedTaggedToTaggedSigned();

14
test/mjsunit/regress/regress-crbug-656275.js Normal file
View File

@ -0,0 +1,14 @@
// Copyright 2016 the V8 project authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
// Flags: --allow-natives-syntax
var a = 1;
function foo(x) { a = Math.fround(x + 1); }
foo(1);
foo(1);
%OptimizeFunctionOnNextCall(foo);
foo(1.3);