Reviewers: jarin,
Description:
Better narrow the derived type for the right shift operation.
Currently the derived type of a right shift does not narrow the input
type based on the actual shift amount - well it does some narrowing
but more can be down. For patterns such as u32[i>>2], which is very
common is asm.js code, this limits the ability to later prove that an
index bounds check is unnecessary which can have a significant
performance impact.
BUG=
Please review this at https://codereview.chromium.org/873143002/
Base URL: https://chromium.googlesource.com/v8/v8.git@master
Affected files (+5, -0 lines):
M AUTHORS
M src/compiler/typer.cc
Index: AUTHORS
diff --git a/AUTHORS b/AUTHORS
index
af57f20acbc74f522fc19ca68576c05a3b4679bc..c22d2e1dd872bc7c324996d99120b886acaa9610
100644
--- a/AUTHORS
+++ b/AUTHORS
@@ -46,6 +46,7 @@ Craig Schlenter <[email protected]>
Christopher A. Taylor <[email protected]>
Daniel Andersson <[email protected]>
Daniel James <[email protected]>
+Douglas Crosher <[email protected]>
Erich Ocean <[email protected]>
Fedor Indutny <[email protected]>
Felix Geisendörfer <[email protected]>
Index: src/compiler/typer.cc
diff --git a/src/compiler/typer.cc b/src/compiler/typer.cc
index
4b3a8830a0fff9cbed6694b9588742225d262814..b63452f6cb31e004da08a2d5e3f2ae80d5e0121b
100644
--- a/src/compiler/typer.cc
+++ b/src/compiler/typer.cc
@@ -916,11 +916,15 @@ Type* Typer::Visitor::JSShiftRightTyper(Type* lhs,
Type* rhs, Typer* t) {
// Right-shifting a non-negative value cannot make it negative, nor
larger.
min = std::max(min, 0.0);
max = std::min(max, lhs->Max());
+ if (rhs->Min() > 0 && rhs->Max() <= 31)
+ max = static_cast<int>(max) >> static_cast<int>(rhs->Min());
}
if (lhs->Max() < 0) {
// Right-shifting a negative value cannot make it non-negative, nor
smaller.
min = std::max(min, lhs->Min());
max = std::min(max, -1.0);
+ if (rhs->Min() > 0 && rhs->Max() <= 31)
+ min = static_cast<int>(min) >> static_cast<int>(rhs->Min());
}
if (rhs->Min() > 0 && rhs->Max() <= 31) {
// Right-shifting by a positive value yields a small integer value.
--
--
v8-dev mailing list
[email protected]
http://groups.google.com/group/v8-dev
---
You received this message because you are subscribed to the Google Groups "v8-dev" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
For more options, visit https://groups.google.com/d/optout.
