AuroraMiddleware/v8
1
0
Fork 0
Code Issues 2 Pull Requests Releases Wiki Activity

Fix Math.round/floor that had bogus Smi representation

Browse Source 
BUG=chromium:272564
R=verwaest@chromium.org

Review URL: https://codereview.chromium.org/23022005

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@16185 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
This commit is contained in:
jkummerow@chromium.org 2013-08-14 12:14:08 +00:00
parent 8e11d9c5c0
commit e71a91ca08
3 changed files with 50 additions and 23 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
src/hydrogen-instructions.cc
View File

@ -3175,8 +3175,6 @@ Representation HUnaryMathOperation::RepresentationFromInputs() {
Representation input_rep = value()->representation();
if (!input_rep.IsTagged()) {
rep = rep.generalize(input_rep);
} else if (flexible_int()) {
rep = Representation::Integer32();
}
return rep;
}

22
src/hydrogen-instructions.h
View File

@ -2433,21 +2433,6 @@ class HUnaryMathOperation: public HTemplateInstruction<2> {
}
}
virtual void UpdateRepresentation(Representation new_rep,
HInferRepresentationPhase* h_infer,
const char* reason) {
if (flexible_int() && !new_rep.IsSmi()) {
new_rep = Representation::Integer32();
}
HValue::UpdateRepresentation(new_rep, h_infer, reason);
}
virtual void RepresentationChanged(Representation new_rep) {
if (flexible_int() && new_rep.IsInteger32()) {
ClearFlag(kFlexibleRepresentation);
}
}
virtual Range* InferRange(Zone* zone);
virtual HValue* Canonicalize();
@ -2465,10 +2450,6 @@ class HUnaryMathOperation: public HTemplateInstruction<2> {
}
private:
bool flexible_int() {
return op_ == kMathFloor || op_ == kMathRound;
}
HUnaryMathOperation(HValue* context, HValue* value, BuiltinFunctionId op)
: HTemplateInstruction<2>(HType::TaggedNumber()), op_(op) {
SetOperandAt(0, context);
@ -2476,8 +2457,7 @@ class HUnaryMathOperation: public HTemplateInstruction<2> {
switch (op) {
case kMathFloor:
case kMathRound:
set_representation(Representation::Smi());
SetFlag(kFlexibleRepresentation);
set_representation(Representation::Integer32());
break;
case kMathAbs:
// Not setting representation here: it is None intentionally.

49
test/mjsunit/regress/regress-crbug-272564.js Normal file
View File

@ -0,0 +1,49 @@
// Copyright 2013 the V8 project authors. All rights reserved.
// Redistribution and use in source and binary forms, with or without
// modification, are permitted provided that the following conditions are
// met:
//
// * Redistributions of source code must retain the above copyright
// notice, this list of conditions and the following disclaimer.
// * Redistributions in binary form must reproduce the above
// copyright notice, this list of conditions and the following
// disclaimer in the documentation and/or other materials provided
// with the distribution.
// * Neither the name of Google Inc. nor the names of its
// contributors may be used to endorse or promote products derived
// from this software without specific prior written permission.
//
// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
// Flags: --allow-natives-syntax
function Bb(w) {
this.width = w;
}
function ce(a, b) {
"number" == typeof a && (a = (b ? Math.round(a) : a) + "px");
return a
}
function pe(a, b, c) {
if (b instanceof Bb) b = b.width;
a.width = ce(b, !0);
}
var a = new Bb(1);
var b = new Bb(5);
pe(a, b, 0);
pe(a, b, 0);
%OptimizeFunctionOnNextCall(pe);
pe(a, b, 0);