diff options
author | Michaël Zasso <targos@protonmail.com> | 2021-04-27 11:14:22 +0300 |
---|---|---|
committer | Michaël Zasso <targos@protonmail.com> | 2021-04-30 13:54:22 +0300 |
commit | 329ee8bbc3f276e3260524ad6fa14bb07442096f (patch) | |
tree | 192d7dcfae85bde4ed6a0214a56333472ad59b11 /deps | |
parent | bda15149f852aa8b2ce00c2902bc73cf54fc3ca7 (diff) |
deps: V8: cherry-pick bbc59d124ef3
Original commit message:
M86-LTS: [compiler] Fix bug in RepresentationChanger::GetWord32RepresentationFor
We have to respect the TypeCheckKind.
(cherry picked from commit fd29e246f65a7cee130e72cd10f618f3b82af232)
No-Try: true
No-Presubmit: true
No-Tree-Checks: true
Bug: chromium:1195777
Change-Id: If1eed719fef79b7c61d99c29ba869ddd7985c413
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2817791
Commit-Queue: Georg Neis <neis@chromium.org>
Reviewed-by: Nico Hartmann <nicohartmann@chromium.org>
Cr-Original-Commit-Position: refs/heads/master@{#73909}
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2838235
Owners-Override: Achuith Bhandarkar <achuith@chromium.org>
Reviewed-by: Artem Sumaneev <asumaneev@google.com>
Commit-Queue: Achuith Bhandarkar <achuith@chromium.org>
Cr-Commit-Position: refs/branch-heads/8.6@{#79}
Cr-Branched-From: a64aed2333abf49e494d2a5ce24bbd14fff19f60-refs/heads/8.6.395@{#1}
Cr-Branched-From: a626bc036236c9bf92ac7b87dc40c9e538b087e3-refs/heads/master@{#69472}
Refs: https://github.com/v8/v8/commit/bbc59d124ef39ba28061b0f60006f89b21d9d8df
PR-URL: https://github.com/nodejs/node/pull/38275
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
Reviewed-By: Jiawen Geng <technicalcute@gmail.com>
Reviewed-By: Shelley Vohr <codebytere@gmail.com>
Diffstat (limited to 'deps')
-rw-r--r-- | deps/v8/src/compiler/representation-change.cc | 8 | ||||
-rw-r--r-- | deps/v8/test/mjsunit/compiler/regress-1195777.js | 62 |
2 files changed, 66 insertions, 4 deletions
diff --git a/deps/v8/src/compiler/representation-change.cc b/deps/v8/src/compiler/representation-change.cc index 7077f7d643f..0ef026aa6ee 100644 --- a/deps/v8/src/compiler/representation-change.cc +++ b/deps/v8/src/compiler/representation-change.cc @@ -919,10 +919,10 @@ Node* RepresentationChanger::GetWord32RepresentationFor( return node; } else if (output_rep == MachineRepresentation::kWord64) { if (output_type.Is(Type::Signed32()) || - output_type.Is(Type::Unsigned32())) { - op = machine()->TruncateInt64ToInt32(); - } else if (output_type.Is(cache_->kSafeInteger) && - use_info.truncation().IsUsedAsWord32()) { + (output_type.Is(Type::Unsigned32()) && + use_info.type_check() == TypeCheckKind::kNone) || + (output_type.Is(cache_->kSafeInteger) && + use_info.truncation().IsUsedAsWord32())) { op = machine()->TruncateInt64ToInt32(); } else if (use_info.type_check() == TypeCheckKind::kSignedSmall || use_info.type_check() == TypeCheckKind::kSigned32 || diff --git a/deps/v8/test/mjsunit/compiler/regress-1195777.js b/deps/v8/test/mjsunit/compiler/regress-1195777.js new file mode 100644 index 00000000000..b122f4f0169 --- /dev/null +++ b/deps/v8/test/mjsunit/compiler/regress-1195777.js @@ -0,0 +1,62 @@ +// Copyright 2021 the V8 project authors. All rights reserved. +// Use of this source code is governed by a BSD-style license that can be +// found in the LICENSE file. + +// Flags: --allow-natives-syntax + + +(function() { + function foo(b) { + let y = (new Date(42)).getMilliseconds(); + let x = -1; + if (b) x = 0xFFFF_FFFF; + return y < Math.max(1 << y, x, 1 + y); + } + assertTrue(foo(true)); + %PrepareFunctionForOptimization(foo); + assertTrue(foo(false)); + %OptimizeFunctionOnNextCall(foo); + assertTrue(foo(true)); +})(); + + +(function() { + function foo(b) { + let x = 0; + if (b) x = -1; + return x == Math.max(-1, x >>> Infinity); + } + assertFalse(foo(true)); + %PrepareFunctionForOptimization(foo); + assertTrue(foo(false)); + %OptimizeFunctionOnNextCall(foo); + assertFalse(foo(true)); +})(); + + +(function() { + function foo(b) { + let x = -1; + if (b) x = 0xFFFF_FFFF; + return -1 < Math.max(0, x, -1); + } + assertTrue(foo(true)); + %PrepareFunctionForOptimization(foo); + assertTrue(foo(false)); + %OptimizeFunctionOnNextCall(foo); + assertTrue(foo(true)); +})(); + + +(function() { + function foo(b) { + let x = 0x7FFF_FFFF; + if (b) x = 0; + return 0 < (Math.max(-5 >>> x, -5) % -5); + } + assertTrue(foo(true)); + %PrepareFunctionForOptimization(foo); + assertTrue(foo(false)); + %OptimizeFunctionOnNextCall(foo); + assertTrue(foo(true)); +})(); |