[regexp] Fix Smi truncation preventing tier-up

Fix tier-up issue where we would continue to execute bytecode instead of
tiering-up on x64. The problem was that the smi value is stored in upper
32 bits which would get truncated, so we were checking the wrong value.

Change-Id: I609b56ad58621c6ab7642d0ce453563ce09ae097
Bug: v8:9566
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1773269
Commit-Queue: Ana Pesko <anapesko@google.com>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Peter Marshall <petermarshall@chromium.org>
Cr-Commit-Position: refs/heads/master@{#63440}
This commit is contained in:
Ana Peško 2019-08-29 10:19:26 +02:00 committed by Commit Bot
parent bb5b15c1fd
commit dc5a644d72

View File

@ -560,7 +560,7 @@ TNode<HeapObject> RegExpBuiltinsAssembler::RegExpExecInternal(
// Tier-up in runtime to compiler if ticks are non-zero.
TNode<Smi> ticks = CAST(
UnsafeLoadFixedArrayElement(data, JSRegExp::kIrregexpTierUpTicksIndex));
GotoIf(TruncateIntPtrToInt32(BitcastTaggedSignedToWord(ticks)), &runtime);
GotoIf(SmiToInt32(ticks), &runtime);
IncrementCounter(isolate()->counters()->regexp_entry_native(), 1);