Reviewers: Benedikt Meurer,
Message:
From class HConstant in hydrogen-instructions.h:
int32_t NumberValueAsInteger32() const {
DCHECK(HasNumberValue());
// Irrespective of whether a numeric HConstant can be safely
// represented as an int32, we store the (in some cases lossy)
// representation of the number in int32_value_.
return int32_value_;
}
PTAL, and CQ it if you like it.
Description:
Fix HConstant(double, ...) constructor
It must always populate int32_value_, even if that's lossy, because other
code
(specifically, constant folding for truncating operations) relies on it.
BUG=v8:3865
LOG=y
Please review this at https://codereview.chromium.org/897263002/
Base URL: https://chromium.googlesource.com/v8/v8.git@master
Affected files (+6, -9 lines):
M src/hydrogen-instructions.cc
A + test/mjsunit/regress/regress-3865.js
Index: src/hydrogen-instructions.cc
diff --git a/src/hydrogen-instructions.cc b/src/hydrogen-instructions.cc
index
ef454e2c4e4604310f861683e0a9cfaea04d9656..ccd4aae5f2c399a1c2b2a043e15dc77e4f26d02f
100644
--- a/src/hydrogen-instructions.cc
+++ b/src/hydrogen-instructions.cc
@@ -2810,7 +2810,7 @@ HConstant::HConstant(double double_value,
Representation r,
!std::isnan(double_value)) |
IsUndetectableField::encode(false) |
InstanceTypeField::encode(kUnknownInstanceType)),
- int32_value_(HasInteger32Value() ? DoubleToInt32(double_value) : 0),
+ int32_value_(DoubleToInt32(double_value)),
double_value_(double_value) {
bit_field_ = HasSmiValueField::update(
bit_field_, HasInteger32Value() && Smi::IsValid(int32_value_));
Index: test/mjsunit/regress/regress-3865.js
diff --git a/test/mjsunit/regress/regress-451322.js
b/test/mjsunit/regress/regress-3865.js
similarity index 68%
copy from test/mjsunit/regress/regress-451322.js
copy to test/mjsunit/regress/regress-3865.js
index
b7794f52f06081f1d047638ef42364a619a6c863..0d1d02f00da3c070b157607a112f3f09bf0756a9
100644
--- a/test/mjsunit/regress/regress-451322.js
+++ b/test/mjsunit/regress/regress-3865.js
@@ -4,14 +4,11 @@
// Flags: --allow-natives-syntax
-var foo = 0;
-
function bar() {
- var baz = 0 - {};
- if (foo > 24) return baz * 0;
+ var radix = 10;
+ return 21 / radix | 0;
}
-
-bar();
-bar();
+assertEquals(2, bar());
+assertEquals(2, bar());
%OptimizeFunctionOnNextCall(bar);
-bar();
+assertEquals(2, bar());
--
--
v8-dev mailing list
[email protected]
http://groups.google.com/group/v8-dev
---
You received this message because you are subscribed to the Google Groups "v8-dev" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
For more options, visit https://groups.google.com/d/optout.
