AuroraMiddleware/v8
1
0
Fork 0
Code Issues 2 Pull Requests Releases Wiki Activity

[turbofan] Another fix for induction variable typing monotonicity.

Browse Source 
BUG=chromium:645851

Review-Url: https://codereview.chromium.org/2332633002
Cr-Commit-Position: refs/heads/master@{#39358}
This commit is contained in:
jarin 2016-09-12 10:04:46 -07:00 committed by Commit bot
parent 58325e616d
commit e031451cd7
2 changed files with 21 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
src/compiler/typer.cc
View File

@ -649,7 +649,8 @@ Type* Typer::Visitor::TypeInductionVariablePhi(Node* node) {
}
// If we do not have enough type information for the initial value or
// the increment, just return the initial value's type.
if (!initial_type->IsInhabited() || !increment_type->IsInhabited()) {
if (!initial_type->IsInhabited() ||
increment_type->Is(typer_->cache_.kSingletonZero)) {
return initial_type;
}

19
test/mjsunit/compiler/regress-645851.js Normal file
View File

@ -0,0 +1,19 @@
// Copyright 2016 the V8 project authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
// Flags: --allow-natives-syntax
function f() {
var sum = 0;
while (1) {
for (var j = 0; j < 200; j -= j) {
sum = sum + 1;
%OptimizeOsr();
if (sum == 2) return;
}
}
return sum;
}
f();