diff options
| author | Michaël Zasso <targos@protonmail.com> | 2021-04-30 13:56:37 +0300 |
|---|---|---|
| committer | Danielle Adams <adamzdanielle@gmail.com> | 2021-05-08 19:44:48 +0300 |
| commit | 5ede8adc4476c1dd276250d3efd81309424c2cc2 (patch) | |
| tree | 4084594c747e6db67e4a24fd1ed511383662d7fe /deps | |
| parent | 402ba0bfd291ab45f1b8df9543ef92e7a9879c89 (diff) | |
deps: V8: cherry-pick ab2340a9b994
Original commit message:
M86-LTS: [compiler] Fix a bug in VisitSpeculativeIntegerAdditiveOp
(cherry picked from commit 9313c4ce3f32ad81df1c65becccec7e129181ce3)
No-Try: true
No-Presubmit: true
No-Tree-Checks: true
Bug: chromium:1199345
Change-Id: I33bf71b33f43919fec4684054b5bf0a0787930ca
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2831478
Reviewed-by: Nico Hartmann <nicohartmann@chromium.org>
Commit-Queue: Georg Neis <neis@chromium.org>
Cr-Original-Commit-Position: refs/heads/master@{#74008}
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2848412
Commit-Queue: Artem Sumaneev <asumaneev@google.com>
Reviewed-by: Victor-Gabriel Savu <vsavu@google.com>
Cr-Commit-Position: refs/branch-heads/8.6@{#86}
Cr-Branched-From: a64aed2333abf49e494d2a5ce24bbd14fff19f60-refs/heads/8.6.395@{#1}
Cr-Branched-From: a626bc036236c9bf92ac7b87dc40c9e538b087e3-refs/heads/master@{#69472}
Refs: https://github.com/v8/v8/commit/ab2340a9b99409c94553eea0f79eed0e19903107
PR-URL: https://github.com/nodejs/node/pull/38481
Reviewed-By: Richard Lau <rlau@redhat.com>
Diffstat (limited to 'deps')
| -rw-r--r-- | deps/v8/src/compiler/simplified-lowering.cc | 11 |
1 files changed, 8 insertions, 3 deletions
diff --git a/deps/v8/src/compiler/simplified-lowering.cc b/deps/v8/src/compiler/simplified-lowering.cc index a9229617dad..156d4fcef05 100644 --- a/deps/v8/src/compiler/simplified-lowering.cc +++ b/deps/v8/src/compiler/simplified-lowering.cc @@ -1426,10 +1426,15 @@ class RepresentationSelector { Type right_feedback_type = TypeOf(node->InputAt(1)); // Using Signed32 as restriction type amounts to promising there won't be - // signed overflow. This is incompatible with relying on a Word32 - // truncation in order to skip the overflow check. + // signed overflow. This is incompatible with relying on a Word32 truncation + // in order to skip the overflow check. Similarly, we must not drop -0 from + // the result type unless we deopt for -0 inputs. Type const restriction = - truncation.IsUsedAsWord32() ? Type::Any() : Type::Signed32(); + truncation.IsUsedAsWord32() + ? Type::Any() + : (truncation.identify_zeros() == kIdentifyZeros) + ? Type::Signed32OrMinusZero() + : Type::Signed32(); // Handle the case when no int32 checks on inputs are necessary (but // an overflow check is needed on the output). Note that we do not |