Commit 329ee8b
committed
deps: V8: cherry-pick bbc59d124ef3
Original commit message:
M86-LTS: [compiler] Fix bug in RepresentationChanger::GetWord32RepresentationFor
We have to respect the TypeCheckKind.
(cherry picked from commit fd29e246f65a7cee130e72cd10f618f3b82af232)
No-Try: true
No-Presubmit: true
No-Tree-Checks: true
Bug: chromium:1195777
Change-Id: If1eed719fef79b7c61d99c29ba869ddd7985c413
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2817791
Commit-Queue: Georg Neis <neis@chromium.org>
Reviewed-by: Nico Hartmann <nicohartmann@chromium.org>
Cr-Original-Commit-Position: refs/heads/master@{#73909}
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2838235
Owners-Override: Achuith Bhandarkar <achuith@chromium.org>
Reviewed-by: Artem Sumaneev <asumaneev@google.com>
Commit-Queue: Achuith Bhandarkar <achuith@chromium.org>
Cr-Commit-Position: refs/branch-heads/8.6@{#79}
Cr-Branched-From: a64aed2333abf49e494d2a5ce24bbd14fff19f60-refs/heads/8.6.395@{#1}
Cr-Branched-From: a626bc036236c9bf92ac7b87dc40c9e538b087e3-refs/heads/master@{#69472}
Refs: v8/v8@bbc59d1
PR-URL: #38275
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
Reviewed-By: Jiawen Geng <technicalcute@gmail.com>
Reviewed-By: Shelley Vohr <codebytere@gmail.com>1 parent bda1514 commit 329ee8b
3 files changed
Lines changed: 67 additions & 5 deletions
File tree
- deps/v8
- src/compiler
- test/mjsunit/compiler
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
@@ -36,7 +36,7 @@ | |||
| 36 | 36 | ||
| 37 | 37 | # Reset this number to 0 on major V8 upgrades. | |
| 38 | 38 | # Increment by one for each non-official patch applied to deps/v8. | |
| 39 | - 'v8_embedder_string': '-node.59', | ||
| 39 | + 'v8_embedder_string': '-node.60', | ||
| 40 | 40 | ||
| 41 | 41 | ##### V8 defaults for Node.js ##### | |
| 42 | 42 | ||
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
@@ -919,10 +919,10 @@ Node* RepresentationChanger::GetWord32RepresentationFor( | |||
| 919 | 919 | return node; | |
| 920 | 920 | } else if (output_rep == MachineRepresentation::kWord64) { | |
| 921 | 921 | if (output_type.Is(Type::Signed32()) || | |
| 922 | - output_type.Is(Type::Unsigned32())) { | ||
| 923 | - op = machine()->TruncateInt64ToInt32(); | ||
| 924 | - } else if (output_type.Is(cache_->kSafeInteger) && | ||
| 925 | - use_info.truncation().IsUsedAsWord32()) { | ||
| 922 | + (output_type.Is(Type::Unsigned32()) && | ||
| 923 | + use_info.type_check() == TypeCheckKind::kNone) || | ||
| 924 | + (output_type.Is(cache_->kSafeInteger) && | ||
| 925 | + use_info.truncation().IsUsedAsWord32())) { | ||
| 926 | 926 | op = machine()->TruncateInt64ToInt32(); | |
| 927 | 927 | } else if (use_info.type_check() == TypeCheckKind::kSignedSmall || | |
| 928 | 928 | use_info.type_check() == TypeCheckKind::kSigned32 || | |
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
@@ -0,0 +1,62 @@ | |||
| 1 | + // Copyright 2021 the V8 project authors. All rights reserved. | ||
| 2 | + // Use of this source code is governed by a BSD-style license that can be | ||
| 3 | + // found in the LICENSE file. | ||
| 4 | + | ||
| 5 | + // Flags: --allow-natives-syntax | ||
| 6 | + | ||
| 7 | + | ||
| 8 | + (function() { | ||
| 9 | + function foo(b) { | ||
| 10 | + let y = (new Date(42)).getMilliseconds(); | ||
| 11 | + let x = -1; | ||
| 12 | + if (b) x = 0xFFFF_FFFF; | ||
| 13 | + return y < Math.max(1 << y, x, 1 + y); | ||
| 14 | + } | ||
| 15 | + assertTrue(foo(true)); | ||
| 16 | + %PrepareFunctionForOptimization(foo); | ||
| 17 | + assertTrue(foo(false)); | ||
| 18 | + %OptimizeFunctionOnNextCall(foo); | ||
| 19 | + assertTrue(foo(true)); | ||
| 20 | + })(); | ||
| 21 | + | ||
| 22 | + | ||
| 23 | + (function() { | ||
| 24 | + function foo(b) { | ||
| 25 | + let x = 0; | ||
| 26 | + if (b) x = -1; | ||
| 27 | + return x == Math.max(-1, x >>> Infinity); | ||
| 28 | + } | ||
| 29 | + assertFalse(foo(true)); | ||
| 30 | + %PrepareFunctionForOptimization(foo); | ||
| 31 | + assertTrue(foo(false)); | ||
| 32 | + %OptimizeFunctionOnNextCall(foo); | ||
| 33 | + assertFalse(foo(true)); | ||
| 34 | + })(); | ||
| 35 | + | ||
| 36 | + | ||
| 37 | + (function() { | ||
| 38 | + function foo(b) { | ||
| 39 | + let x = -1; | ||
| 40 | + if (b) x = 0xFFFF_FFFF; | ||
| 41 | + return -1 < Math.max(0, x, -1); | ||
| 42 | + } | ||
| 43 | + assertTrue(foo(true)); | ||
| 44 | + %PrepareFunctionForOptimization(foo); | ||
| 45 | + assertTrue(foo(false)); | ||
| 46 | + %OptimizeFunctionOnNextCall(foo); | ||
| 47 | + assertTrue(foo(true)); | ||
| 48 | + })(); | ||
| 49 | + | ||
| 50 | + | ||
| 51 | + (function() { | ||
| 52 | + function foo(b) { | ||
| 53 | + let x = 0x7FFF_FFFF; | ||
| 54 | + if (b) x = 0; | ||
| 55 | + return 0 < (Math.max(-5 >>> x, -5) % -5); | ||
| 56 | + } | ||
| 57 | + assertTrue(foo(true)); | ||
| 58 | + %PrepareFunctionForOptimization(foo); | ||
| 59 | + assertTrue(foo(false)); | ||
| 60 | + %OptimizeFunctionOnNextCall(foo); | ||
| 61 | + assertTrue(foo(true)); | ||
| 62 | + })(); | ||
0 commit comments