v8/test/mjsunit/regress/regress-1400897.js
Qifan Pan 4c4edc85ea [turbofan] Fix bugs of BigInt constructor inlining
This CL handles the conversion from Float64 (MinusZero) to Word64 in
the representation changer.

In the original CL, the range of Numbers eligible for optimization was
incorrectly set to Integral32OrMinusZero. This CL narrows it down to
Signed32OrMinusZero or Unsigned32OrMinusZero (but not the union).

Bug: v8:9407, chromium:1400897
Change-Id: I0f09eb512e77b145b081ad5d52ca03f61d49dc62
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4110761
Reviewed-by: Nico Hartmann <nicohartmann@chromium.org>
Commit-Queue: Qifan Pan <panq@google.com>
Cr-Commit-Position: refs/heads/main@{#84896}
2022-12-16 10:19:43 +00:00

30 lines
652 B
JavaScript

// Copyright 2022 the V8 project authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
// Flags: --allow-natives-syntax
function bar() {
const x = 0;
return BigInt(x * -1);
}
%PrepareFunctionForOptimization(bar);
assertEquals(0n, bar());
%OptimizeFunctionOnNextCall(bar);
assertEquals(0n, bar());
function foo() {
let result = 0n;
let obj = {i: 0};
for (; obj.i < 1; ++obj.i) {
result += BigInt(obj.i * -2);
}
return result;
}
%PrepareFunctionForOptimization(foo);
assertEquals(0n, foo());
%OptimizeFunctionOnNextCall(foo);
assertEquals(0n, foo());