c5c6b8bc03
BinaryNumberOpTyper was not monotonic: if one input changes from Number to Numeric, while the other input stays BigInt, the result would change from Number to BigInt. We have some fuzzing tests for monotonicity but unfortunately they never generated the inputs required for triggering this bug. We'll look into improving our tests. Bug: v8:8380 Change-Id: I7320d9ae4b89ad8798bf9e97cc272edba2162a77 Reviewed-on: https://chromium-review.googlesource.com/c/1307418 Commit-Queue: Hai Dang <dhai@google.com> Reviewed-by: Georg Neis <neis@chromium.org> Cr-Commit-Position: refs/heads/master@{#57125}
33 lines
594 B
JavaScript
33 lines
594 B
JavaScript
// Copyright 2018 the V8 project authors. All rights reserved.
|
|
// Use of this source code is governed by a BSD-style license that can be
|
|
// found in the LICENSE file.
|
|
|
|
// Flags: --allow-natives-syntax
|
|
|
|
function reduceLHS() {
|
|
for (var i = 0; i < 2 ;i++) {
|
|
let [q, r] = [1n, 1n];
|
|
r = r - 1n;
|
|
q += 1n;
|
|
q = r;
|
|
}
|
|
}
|
|
|
|
reduceLHS();
|
|
%OptimizeFunctionOnNextCall(reduceLHS);
|
|
reduceLHS();
|
|
|
|
|
|
function reduceRHS() {
|
|
for (var i = 0; i < 2 ;i++) {
|
|
let [q, r] = [1n, 1n];
|
|
r = 1n - r;
|
|
q += 1n;
|
|
q = r;
|
|
}
|
|
}
|
|
|
|
reduceRHS();
|
|
%OptimizeFunctionOnNextCall(reduceRHS);
|
|
reduceRHS();
|