AuroraMiddleware/v8
1
0
Fork 0
Code Issues 2 Pull Requests Releases Wiki Activity

[crankshaft] Fix invalid number truncation assumption on HAdd inputs.

Browse Source 
In Crankshaft we don't know reliably know that an HAdd might not turn
into a string addition later (via deoptimization), so we cannot set the
HValue::kAllowUndefinedAsNaN flag on the HAdd instruction in those
cases. It doesn't seem to affect performance if we just remove the flag
completely from the HAdd instruction, so let's stick to that approach
for now.

R=jarin@chromium.org
BUG=v8:5074

Review-Url: https://codereview.chromium.org/2048643002
Cr-Commit-Position: refs/heads/master@{#36805}
This commit is contained in:
bmeurer 2016-06-07 20:55:25 -07:00 committed by Commit bot
parent 026ed50506
commit f576e29c47
2 changed files with 23 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
src/crankshaft/hydrogen-instructions.h
View File

@ -4370,6 +4370,11 @@ class HAdd final : public HArithmeticBinaryOperation {
SetChangesFlag(kNewSpacePromotion);
ClearFlag(kAllowUndefinedAsNaN);
}
if (!right()->type().IsTaggedNumber() &&
!right()->representation().IsDouble() &&
!right()->representation().IsSmiOrInteger32()) {
ClearFlag(kAllowUndefinedAsNaN);
}
}
Representation RepresentationFromInputs() override;

18
test/mjsunit/compiler/regress-5074.js Normal file
View File

@ -0,0 +1,18 @@
// Copyright 2016 the V8 project authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
// Flags: --allow-natives-syntax
var s = [,0.1];
function foo(a, b) {
var x = s[a];
s[1] = 0.1;
return x + b;
}
assertEquals(2.1, foo(1, 2));
assertEquals(2.1, foo(1, 2));
%OptimizeFunctionOnNextCall(foo);
assertEquals("undefined2", foo(0, "2"));