v8/test/mjsunit/regress/regress-unsigned-mul-add.js
Jaroslav Sevcik c3af691e72 [turbofan] Remove int32 narrowing during typed lowering.
With Int32Add we lose the int/uint distinction, so later, in simplified lowering we can make a wrong decision. E.g., see the attached test case, where we lower NumberAdd -> Int32Add because inputs are Uint32, but during simplified lowering we change the inputs to Int32, so we get a wrong result.

Simplified lowering will lower the NumberAdd operations anyway, so we should lose performance.

BUG=
R=bmeurer@chromium.org

Review URL: https://codereview.chromium.org/721723004

Cr-Commit-Position: refs/heads/master@{#25368}
2014-11-17 09:04:52 +00:00

11 lines
266 B
JavaScript

// Copyright 2014 the V8 project authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
function f(a) {
var x = a >>> 0;
return (x * 1.0 + x * 1.0) << 0;
}
assertEquals(-2, f(-1));