a758144329
When we narrow a signed32 comparison to uint8 or uint16 representation, we also need to change the condition to unsigned comparisons otherwise the comparison will be done on int16/int8 which interprets the narrowed bits wrong. R=epertoso@chromium.org BUG=v8:5254 Review-Url: https://codereview.chromium.org/2202803003 Cr-Commit-Position: refs/heads/master@{#38231}
28 lines
566 B
JavaScript
28 lines
566 B
JavaScript
// Copyright 2016 the V8 project authors. All rights reserved.
|
|
// Use of this source code is governed by a BSD-style license that can be
|
|
// found in the LICENSE file.
|
|
|
|
// Flags: --allow-natives-syntax
|
|
|
|
var foo = (function() {
|
|
"use asm";
|
|
var a = new Uint8Array(2);
|
|
a[0] = 128;
|
|
a[1] = 127;
|
|
|
|
function foo() {
|
|
var x = a[0]|0;
|
|
var y = a[1]|0;
|
|
if (x < 0) x = 4294967296 + x|0;
|
|
if (y < 0) y = 4294967296 + y|0;
|
|
return x >= y;
|
|
}
|
|
|
|
return foo;
|
|
})();
|
|
|
|
assertTrue(foo());
|
|
assertTrue(foo());
|
|
%OptimizeFunctionOnNextCall(foo);
|
|
assertTrue(foo());
|