AuroraMiddleware/v8
1
0
Fork 0
Code Issues 2 Pull Requests Releases Wiki Activity

[Crankshaft] Don't do HMathFloorOfDiv optimization for kUint32 values

Browse Source 
BUG=v8:4507
LOG=y
R=bmeurer@chromium.org

Review URL: https://codereview.chromium.org/1409353005

Cr-Commit-Position: refs/heads/master@{#31474}
This commit is contained in:
jkummerow 2015-10-22 06:21:39 -07:00 committed by Commit bot
parent 034f4a6ae1
commit fdfab67243
2 changed files with 26 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

11
src/crankshaft/hydrogen-instructions.cc
View File

@ -1581,9 +1581,10 @@ HValue* HUnaryMathOperation::Canonicalize() {
HDiv* hdiv = HDiv::cast(value());
HValue* left = hdiv->left();
if (left->representation().IsInteger32()) {
if (left->representation().IsInteger32() && !left->CheckFlag(kUint32)) {
// A value with an integer representation does not need to be transformed.
} else if (left->IsChange() && HChange::cast(left)->from().IsInteger32()) {
} else if (left->IsChange() && HChange::cast(left)->from().IsInteger32() &&
!HChange::cast(left)->value()->CheckFlag(kUint32)) {
// A change from an integer32 can be replaced by the integer32 value.
left = HChange::cast(left)->value();
} else if (hdiv->observed_input_representation(1).IsSmiOrInteger32()) {
@ -1597,10 +1598,12 @@ HValue* HUnaryMathOperation::Canonicalize() {
if (right->IsInteger32Constant()) {
right = Prepend(HConstant::cast(right)->CopyToRepresentation(
Representation::Integer32(), right->block()->zone()));
} else if (right->representation().IsInteger32()) {
} else if (right->representation().IsInteger32() &&
!right->CheckFlag(kUint32)) {
// A value with an integer representation does not need to be transformed.
} else if (right->IsChange() &&
HChange::cast(right)->from().IsInteger32()) {
HChange::cast(right)->from().IsInteger32() &&
!HChange::cast(right)->value()->CheckFlag(kUint32)) {
// A change from an integer32 can be replaced by the integer32 value.
right = HChange::cast(right)->value();
} else if (hdiv->observed_input_representation(2).IsSmiOrInteger32()) {

19
test/mjsunit/regress/regress-4507.js Normal file
View File

@ -0,0 +1,19 @@
// Copyright 2015 the V8 project authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
// Flags: --allow-natives-syntax
function broken(value) {
return Math.floor(value/65536);
}
function toUnsigned(i) {
return i >>> 0;
}
function outer(i) {
return broken(toUnsigned(i));
}
for (var i = 0; i < 5; i++) outer(0);
broken(0x80000000); // Spice things up with a sprinkling of type feedback.
%OptimizeFunctionOnNextCall(outer);
assertEquals(32768, outer(0x80000000));