AuroraMiddleware/v8
1
0
Fork 0
Code Issues 2 Pull Requests Releases Wiki Activity

[compiler] Fix bug in RepresentationChanger::GetWord32RepresentationFor

Browse Source 
We have to respect the TypeCheckKind.

Bug: chromium:1195777
Change-Id: If1eed719fef79b7c61d99c29ba869ddd7985c413
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2817791
Commit-Queue: Georg Neis <neis@chromium.org>
Reviewed-by: Nico Hartmann <nicohartmann@chromium.org>
Cr-Commit-Position: refs/heads/master@{#73909}
This commit is contained in:
Georg Neis 2021-04-12 12:53:24 +02:00 committed by Commit Bot
parent f87baad0f8
commit fd29e246f6
2 changed files with 66 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
src/compiler/representation-change.cc
View File

@ -949,10 +949,10 @@ Node* RepresentationChanger::GetWord32RepresentationFor(
return node;
} else if (output_rep == MachineRepresentation::kWord64) {
if (output_type.Is(Type::Signed32()) ||
output_type.Is(Type::Unsigned32())) {
op = machine()->TruncateInt64ToInt32();
} else if (output_type.Is(cache_->kSafeInteger) &&
use_info.truncation().IsUsedAsWord32()) {
(output_type.Is(Type::Unsigned32()) &&
use_info.type_check() == TypeCheckKind::kNone) ||
(output_type.Is(cache_->kSafeInteger) &&
use_info.truncation().IsUsedAsWord32())) {
op = machine()->TruncateInt64ToInt32();
} else if (use_info.type_check() == TypeCheckKind::kSignedSmall ||
use_info.type_check() == TypeCheckKind::kSigned32 ||

62
test/mjsunit/compiler/regress-1195777.js Normal file
View File

@ -0,0 +1,62 @@
// Copyright 2021 the V8 project authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
// Flags: --allow-natives-syntax
(function() {
function foo(b) {
let y = (new Date(42)).getMilliseconds();
let x = -1;
if (b) x = 0xFFFF_FFFF;
return y < Math.max(1 << y, x, 1 + y);
}
assertTrue(foo(true));
%PrepareFunctionForOptimization(foo);
assertTrue(foo(false));
%OptimizeFunctionOnNextCall(foo);
assertTrue(foo(true));
})();
(function() {
function foo(b) {
let x = 0;
if (b) x = -1;
return x == Math.max(-1, x >>> Infinity);
}
assertFalse(foo(true));
%PrepareFunctionForOptimization(foo);
assertTrue(foo(false));
%OptimizeFunctionOnNextCall(foo);
assertFalse(foo(true));
})();
(function() {
function foo(b) {
let x = -1;
if (b) x = 0xFFFF_FFFF;
return -1 < Math.max(0, x, -1);
}
assertTrue(foo(true));
%PrepareFunctionForOptimization(foo);
assertTrue(foo(false));
%OptimizeFunctionOnNextCall(foo);
assertTrue(foo(true));
})();
(function() {
function foo(b) {
let x = 0x7FFF_FFFF;
if (b) x = 0;
return 0 < (Math.max(-5 >>> x, -5) % -5);
}
assertTrue(foo(true));
%PrepareFunctionForOptimization(foo);
assertTrue(foo(false));
%OptimizeFunctionOnNextCall(foo);
assertTrue(foo(true));
})();