Reviewers: Benedikt Meurer,
Description:
Fixed Hydrogen environment handling for mul-i on ARM.
The whole logic in DoMul makes me cry, so I made only the minimal
change to fix the issue...
BUG=v8:451322
Please review this at https://codereview.chromium.org/873703002/
Base URL: https://chromium.googlesource.com/v8/v8.git@master
Affected files (+14, -9 lines):
M src/arm/lithium-arm.cc
A + test/mjsunit/regress/regress-451322.js
Index: src/arm/lithium-arm.cc
diff --git a/src/arm/lithium-arm.cc b/src/arm/lithium-arm.cc
index
e5de950334af86261b392603aeb058298224d60b..4ee515900dee162cb1a92de1771afacb829f3566
100644
--- a/src/arm/lithium-arm.cc
+++ b/src/arm/lithium-arm.cc
@@ -1508,9 +1508,10 @@ LInstruction* LChunkBuilder::DoMul(HMul* instr) {
bool can_overflow = instr->CheckFlag(HValue::kCanOverflow);
bool bailout_on_minus_zero =
instr->CheckFlag(HValue::kBailoutOnMinusZero);
+ int32_t constant_value = 0;
if (right->IsConstant()) {
HConstant* constant = HConstant::cast(right);
- int32_t constant_value = constant->Integer32Value();
+ constant_value = constant->Integer32Value();
// Constants -1, 0 and 1 can be optimized if the result can overflow.
// For other constants, it can be optimized only without overflow.
if (!can_overflow || ((constant_value >= -1) && (constant_value <=
1))) {
@@ -1533,7 +1534,10 @@ LInstruction* LChunkBuilder::DoMul(HMul* instr) {
right_op = UseRegister(right);
}
LMulI* mul = new(zone()) LMulI(left_op, right_op);
- if (can_overflow || bailout_on_minus_zero) {
+ if (right_op->IsConstantOperand()
+ ? ((can_overflow && constant_value == -1) ||
+ (bailout_on_minus_zero && constant_value <= 0))
+ : (can_overflow || bailout_on_minus_zero)) {
AssignEnvironment(mul);
}
return DefineAsRegister(mul);
Index: test/mjsunit/regress/regress-451322.js
diff --git a/test/mjsunit/compiler/regress-ntl-effect.js
b/test/mjsunit/regress/regress-451322.js
similarity index 60%
copy from test/mjsunit/compiler/regress-ntl-effect.js
copy to test/mjsunit/regress/regress-451322.js
index
708fe32828c9197dfa3d8c371ab01cbc1ad3317a..b7794f52f06081f1d047638ef42364a619a6c863
100644
--- a/test/mjsunit/compiler/regress-ntl-effect.js
+++ b/test/mjsunit/regress/regress-451322.js
@@ -4,13 +4,14 @@
// Flags: --allow-natives-syntax
-function g() {
- throw 0;
-}
+var foo = 0;
-function f() {
- g();
- while (1) {}
+function bar() {
+ var baz = 0 - {};
+ if (foo > 24) return baz * 0;
}
-assertThrows(function () { f(); });
+bar();
+bar();
+%OptimizeFunctionOnNextCall(bar);
+bar();
--
--
v8-dev mailing list
[email protected]
http://groups.google.com/group/v8-dev
---
You received this message because you are subscribed to the Google Groups "v8-dev" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
For more options, visit https://groups.google.com/d/optout.
