Reviewers: danno,

Message:
Could you take a look, please?

Description:
[turbofan] Fix matching of the lea instruction.

Resets the scaled exponent to 0 when the scaling match fails.

BUG=

Please review this at https://codereview.chromium.org/756643002/

Base URL: https://chromium.googlesource.com/v8/v8.git@master

Affected files (+10, -8 lines):
  M src/compiler/node-matchers.h
  A + test/mjsunit/regress/regress-lea-matching.js


Index: src/compiler/node-matchers.h
diff --git a/src/compiler/node-matchers.h b/src/compiler/node-matchers.h
index c748c61e6a9cc0624c074bde0a579378b067abff..993e0d90e4aab144064a40b86e987975a6c9c4c0 100644
--- a/src/compiler/node-matchers.h
+++ b/src/compiler/node-matchers.h
@@ -307,6 +307,7 @@ struct ScaledWithOffsetMatcher {
           } else {
             // (O + O)
             scaled_ = left;
+            scale_exponent_ = 0;
             offset_ = right;
           }
         } else {
@@ -323,6 +324,7 @@ struct ScaledWithOffsetMatcher {
           } else {
             // (O + O)
             scaled_ = left;
+            scale_exponent_ = 0;
             offset_ = right;
           }
         }
Index: test/mjsunit/regress/regress-lea-matching.js
diff --git a/test/mjsunit/regress/regress-crbug-387636.js b/test/mjsunit/regress/regress-lea-matching.js
similarity index 54%
copy from test/mjsunit/regress/regress-crbug-387636.js
copy to test/mjsunit/regress/regress-lea-matching.js
index 1e50ace45a293c8561042f1a09c8fcd505b43dc2..988368ad0f3dbf0e99e8d9221b77b4d9739482ee 100644
--- a/test/mjsunit/regress/regress-crbug-387636.js
+++ b/test/mjsunit/regress/regress-lea-matching.js
@@ -2,13 +2,13 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.

-// Flags: --allow-natives-syntax
-
-function f() {
-  [].indexOf(0x40000000);
+function f(a, b, c) {
+  a = a|0;
+  b = b|0;
+  c = c|0;
+  var r = 0;
+  r = a + ((b << 1) + c) | 0;
+  return r|0;
 }

-f();
-f();
-%OptimizeFunctionOnNextCall(f);
-f();
+assertEquals(8, f(1, 2, 3));


--
--
v8-dev mailing list
[email protected]
http://groups.google.com/group/v8-dev
--- You received this message because you are subscribed to the Google Groups "v8-dev" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to [email protected].
For more options, visit https://groups.google.com/d/optout.

Reply via email to