AuroraMiddleware/v8
1
0
Fork 0
Code Issues 2 Pull Requests Releases Wiki Activity

[turbofan] Fix representation changing for bigints

Browse Source 
RepresentationChanger::GetTaggedPointerRepresentation did not handle
kCompressed cases correctly for BigInts. This led to a crash of BigInt
benchmarks in js-perf-test.

Bug: v8:9407
Change-Id: Id1d60a81afc528c8d4180bd5de9d237f2f0abd0a
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1701848
Reviewed-by: Georg Neis <neis@chromium.org>
Reviewed-by: Sigurd Schneider <sigurds@chromium.org>
Commit-Queue: Sigurd Schneider <sigurds@chromium.org>
Cr-Commit-Position: refs/heads/master@{#62718}
This commit is contained in:
Nico Hartmann 2019-07-15 16:23:57 +02:00 committed by Commit Bot
parent fd1a211c37
commit ab2ebc296e
2 changed files with 39 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

13
src/compiler/representation-change.cc
View File

@ -473,7 +473,20 @@ Node* RepresentationChanger::GetTaggedPointerRepresentationFor(
}
op = simplified()->CheckBigInt(use_info.feedback());
} else if (output_rep == MachineRepresentation::kCompressedPointer) {
if (use_info.type_check() == TypeCheckKind::kBigInt &&
!output_type.Is(Type::BigInt())) {
node = InsertChangeCompressedToTagged(node);
op = simplified()->CheckBigInt(use_info.feedback());
} else {
op = machine()->ChangeCompressedPointerToTaggedPointer();
}
} else if (output_rep == MachineRepresentation::kCompressed &&
output_type.Is(Type::BigInt())) {
op = machine()->ChangeCompressedPointerToTaggedPointer();
} else if (output_rep == MachineRepresentation::kCompressed &&
use_info.type_check() == TypeCheckKind::kBigInt) {
node = InsertChangeCompressedToTagged(node);
op = simplified()->CheckBigInt(use_info.feedback());
} else if (CanBeCompressedSigned(output_rep) &&
use_info.type_check() == TypeCheckKind::kHeapObject) {
if (!output_type.Maybe(Type::SignedSmall())) {

26
test/mjsunit/compiler/bigint-add.js Normal file
View File

@ -0,0 +1,26 @@
// Copyright 2019 the V8 project authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
// Flags: --allow-natives-syntax --opt
{
let a = 0n;
a = 3n;
function TestAdd() {
let sum = 0n;
for (let i = 0; i < 3; ++i) {
sum = a + sum;
}
return sum;
}
%PrepareFunctionForOptimization(TestAdd);
TestAdd();
TestAdd();
%OptimizeFunctionOnNextCall(TestAdd);
TestAdd();
TestAdd();
}