Reviewers: Benedikt Meurer,
Message:
Could you take a look, please?
Description:
Restrict representation inference to avoid truncation of phi inputs.
BUG=chromium:446778
LOG=N
Please review this at https://codereview.chromium.org/837153002/
Base URL: https://chromium.googlesource.com/v8/v8.git@master
Affected files (+22, -9 lines):
M src/compiler/simplified-lowering.cc
M test/cctest/compiler/test-simplified-lowering.cc
A test/mjsunit/compiler/regress-446778.js
Index: src/compiler/simplified-lowering.cc
diff --git a/src/compiler/simplified-lowering.cc
b/src/compiler/simplified-lowering.cc
index
5f9a406b649dec5a6b0336cffcf7bc29dde16212..1461709dabf9ab2c533e2dfe12e7039d4a993f12
100644
--- a/src/compiler/simplified-lowering.cc
+++ b/src/compiler/simplified-lowering.cc
@@ -307,8 +307,8 @@ class RepresentationSelector {
if ((use & kRepMask) == kRepTagged) {
// only tagged uses.
return kRepTagged;
- } else if (IsSafeIntAdditiveOperand(node)) {
- // Integer within [-2^52, 2^52] range.
+ } else if (upper->Is(Type::Integral32())) {
+ // Integer within [-2^31, 2^32[ range.
if ((use & kRepMask) == kRepFloat64) {
// only float64 uses.
return kRepFloat64;
@@ -318,7 +318,7 @@ class RepresentationSelector {
} else if ((use & kRepMask) == kRepWord32 ||
(use & kTypeMask) == kTypeInt32 ||
(use & kTypeMask) == kTypeUint32) {
- // The type is a safe integer, but we only use 32 bits.
+ // We only use 32 bits or we use the result consistently.
return kRepWord32;
} else {
return kRepFloat64;
Index: test/cctest/compiler/test-simplified-lowering.cc
diff --git a/test/cctest/compiler/test-simplified-lowering.cc
b/test/cctest/compiler/test-simplified-lowering.cc
index
f1cbcbefb36729b171ad14a0708556330aa4d8e5..147aa323ffaf887351b87b46c5015a98d261d343
100644
--- a/test/cctest/compiler/test-simplified-lowering.cc
+++ b/test/cctest/compiler/test-simplified-lowering.cc
@@ -2037,11 +2037,6 @@ TEST(PhiRepresentation) {
HandleAndZoneScope scope;
Zone* z = scope.main_zone();
- Factory* f = z->isolate()->factory();
- Handle<Object> range_min = f->NewNumber(-1e13);
- Handle<Object> range_max = f->NewNumber(1e+15);
- Type* range = Type::Range(range_min, range_max, z);
-
struct TestData {
Type* arg1;
Type* arg2;
@@ -2052,7 +2047,8 @@ TEST(PhiRepresentation) {
TestData test_data[] = {
{Type::Signed32(), Type::Unsigned32(), kMachInt32,
kRepWord32 | kTypeNumber},
- {range, range, kMachUint32, kRepWord32 | kTypeNumber},
+ {Type::Signed32(), Type::Unsigned32(), kMachUint32,
+ kRepWord32 | kTypeNumber},
{Type::Signed32(), Type::Signed32(), kMachInt32, kMachInt32},
{Type::Unsigned32(), Type::Unsigned32(), kMachInt32, kMachUint32},
{Type::Number(), Type::Signed32(), kMachInt32, kMachFloat64},
Index: test/mjsunit/compiler/regress-446778.js
diff --git a/test/mjsunit/compiler/regress-446778.js
b/test/mjsunit/compiler/regress-446778.js
new file mode 100644
index
0000000000000000000000000000000000000000..a7fa3fdad86439a996fefbe52d2161daf94a2ef2
--- /dev/null
+++ b/test/mjsunit/compiler/regress-446778.js
@@ -0,0 +1,17 @@
+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+function Module() {
+ "use asm";
+ function f() {
+ var i = (140737463189505);
+ do {
+ i = i + i | 0;
+ x = undefined + i | 0;
+ } while (!i);
+ }
+ return { f: f };
+}
+
+Module().f();
--
--
v8-dev mailing list
[email protected]
http://groups.google.com/group/v8-dev
---
You received this message because you are subscribed to the Google Groups "v8-dev" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
For more options, visit https://groups.google.com/d/optout.
