AuroraMiddleware/v8
1
0
Fork 0
Code Issues 2 Pull Requests Releases Wiki Activity

[turbofan] Fix lowering of Math.max for integral inputs.

Browse Source 
R=jarin@chromium.org
BUG=chromium:468162
LOG=y

Review URL: https://codereview.chromium.org/1027753002

Cr-Commit-Position: refs/heads/master@{#27341}
This commit is contained in:
bmeurer 2015-03-20 05:05:06 -07:00 committed by Commit bot
parent 2a440ef46a
commit ff89876bb9
3 changed files with 14 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
src/compiler/js-builtin-reducer.cc
View File

@ -118,8 +118,8 @@ Reduction JSBuiltinReducer::ReduceMathMax(Node* node) {
Node* const input = r.GetJSCallInput(i);
value = graph()->NewNode(
common()->Select(kMachNone),
graph()->NewNode(simplified()->NumberLessThan(), input, value), input,
value);
graph()->NewNode(simplified()->NumberLessThan(), input, value), value,
input);
}
return Replace(value);
}

11
test/mjsunit/compiler/regress-468162.js Normal file
View File

@ -0,0 +1,11 @@
// Copyright 2015 the V8 project authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
var asm = (function() {
"use asm";
var max = Math.max;
return function f() { return max(0, -17); };
})();
assertEquals(0, asm());

2
test/unittests/compiler/js-builtin-reducer-unittest.cc
View File

@ -112,7 +112,7 @@ TEST_F(JSBuiltinReducerTest, MathMax2) {
if (t0->Is(Type::Integral32()) && t1->Is(Type::Integral32())) {
ASSERT_TRUE(r.Changed());
EXPECT_THAT(r.replacement(),
IsSelect(kMachNone, IsNumberLessThan(p1, p0), p1, p0));
IsSelect(kMachNone, IsNumberLessThan(p1, p0), p0, p1));
} else {
ASSERT_FALSE(r.Changed());
EXPECT_EQ(IrOpcode::kJSCallFunction, call->opcode());