AuroraMiddleware/v8
1
0
Fork 0
Code Issues 2 Pull Requests Releases Wiki Activity

[crankshaft] Range analysis should not rely on overflowed ranges.

Browse Source 
BUG=chromium:645438

Review-Url: https://codereview.chromium.org/2412853002
Cr-Commit-Position: refs/heads/master@{#40202}
This commit is contained in:
ishell 2016-10-12 02:06:01 -07:00 committed by Commit bot
parent edfe391ef5
commit 9a0109d72e
3 changed files with 37 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

24
src/crankshaft/hydrogen-instructions.cc
View File

@ -259,7 +259,11 @@ bool Range::AddAndCheckOverflow(const Representation& r, Range* other) {
bool may_overflow = false;
lower_ = AddWithoutOverflow(r, lower_, other->lower(), &may_overflow);
upper_ = AddWithoutOverflow(r, upper_, other->upper(), &may_overflow);
KeepOrder();
if (may_overflow) {
Clear();
} else {
KeepOrder();
}
#ifdef DEBUG
Verify();
#endif
@ -271,13 +275,21 @@ bool Range::SubAndCheckOverflow(const Representation& r, Range* other) {
bool may_overflow = false;
lower_ = SubWithoutOverflow(r, lower_, other->upper(), &may_overflow);
upper_ = SubWithoutOverflow(r, upper_, other->lower(), &may_overflow);
KeepOrder();
if (may_overflow) {
Clear();
} else {
KeepOrder();
}
#ifdef DEBUG
Verify();
#endif
return may_overflow;
}
void Range::Clear() {
lower_ = kMinInt;
upper_ = kMaxInt;
}
void Range::KeepOrder() {
if (lower_ > upper_) {
@ -301,8 +313,12 @@ bool Range::MulAndCheckOverflow(const Representation& r, Range* other) {
int v2 = MulWithoutOverflow(r, lower_, other->upper(), &may_overflow);
int v3 = MulWithoutOverflow(r, upper_, other->lower(), &may_overflow);
int v4 = MulWithoutOverflow(r, upper_, other->upper(), &may_overflow);
lower_ = Min(Min(v1, v2), Min(v3, v4));
upper_ = Max(Max(v1, v2), Max(v3, v4));
if (may_overflow) {
Clear();
} else {
lower_ = Min(Min(v1, v2), Min(v3, v4));
upper_ = Max(Max(v1, v2), Max(v3, v4));
}
#ifdef DEBUG
Verify();
#endif

1
src/crankshaft/hydrogen-instructions.h
View File

@ -235,6 +235,7 @@ class Range final : public ZoneObject {
lower_ = Max(lower_, Smi::kMinValue);
upper_ = Min(upper_, Smi::kMaxValue);
}
void Clear();
void KeepOrder();
#ifdef DEBUG
void Verify() const;

16
test/mjsunit/regress/regress-crbug-645438.js Normal file
View File

@ -0,0 +1,16 @@
// Copyright 2016 the V8 project authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
// Flags: --allow-natives-syntax
function n(x,y){
y = (y-(0x80000000|0)|0);
return (x/y)|0;
};
var x = -0x80000000;
var y = 0x7fffffff;
n(x,y);
n(x,y);
%OptimizeFunctionOnNextCall(n);
assertEquals(x, n(x,y));