Reviewers: jarin,
Description:
[turbofan] Fix lowering of Math.max for integral inputs.
[email protected]
BUG=chromium:468162
LOG=y
Please review this at https://codereview.chromium.org/1027753002/
Base URL: https://chromium.googlesource.com/v8/v8.git@master
Affected files (+9, -10 lines):
M src/compiler/js-builtin-reducer.cc
A + test/mjsunit/compiler/regress-468162.js
M test/unittests/compiler/js-builtin-reducer-unittest.cc
Index: src/compiler/js-builtin-reducer.cc
diff --git a/src/compiler/js-builtin-reducer.cc
b/src/compiler/js-builtin-reducer.cc
index
2a032dbfb2dc1d1df44abb07552ae372081aa09e..12b0e2f6cc97d38eb8986ec3f8a19b923ba008a3
100644
--- a/src/compiler/js-builtin-reducer.cc
+++ b/src/compiler/js-builtin-reducer.cc
@@ -118,8 +118,8 @@ Reduction JSBuiltinReducer::ReduceMathMax(Node* node) {
Node* const input = r.GetJSCallInput(i);
value = graph()->NewNode(
common()->Select(kMachNone),
- graph()->NewNode(simplified()->NumberLessThan(), input, value),
input,
- value);
+ graph()->NewNode(simplified()->NumberLessThan(), input, value),
value,
+ input);
}
return Replace(value);
}
Index: test/mjsunit/compiler/regress-468162.js
diff --git a/test/mjsunit/regress/regress-crbug-455644.js
b/test/mjsunit/compiler/regress-468162.js
similarity index 57%
copy from test/mjsunit/regress/regress-crbug-455644.js
copy to test/mjsunit/compiler/regress-468162.js
index
4993d857a89f620df2b0d1f9813a2a382a77bd8d..47bff032d584a37824d55dd1881e8a81a258b7e8
100644
--- a/test/mjsunit/regress/regress-crbug-455644.js
+++ b/test/mjsunit/compiler/regress-468162.js
@@ -2,11 +2,10 @@
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
-(function f() {
- do { return 23; } while(false);
- with (0) {
- try {
- return 42;
- } finally {}
- }
+var asm = (function() {
+ "use asm";
+ var max = Math.max;
+ return function f() { return max(0, -17); };
})();
+
+assertEquals(0, asm());
Index: test/unittests/compiler/js-builtin-reducer-unittest.cc
diff --git a/test/unittests/compiler/js-builtin-reducer-unittest.cc
b/test/unittests/compiler/js-builtin-reducer-unittest.cc
index
c98bc6cdffdc9f95ea28a860f722883d323117b4..5c508a5d4bcd37cb3cd9be15d6134e2f12b9fd46
100644
--- a/test/unittests/compiler/js-builtin-reducer-unittest.cc
+++ b/test/unittests/compiler/js-builtin-reducer-unittest.cc
@@ -112,7 +112,7 @@ TEST_F(JSBuiltinReducerTest, MathMax2) {
if (t0->Is(Type::Integral32()) && t1->Is(Type::Integral32())) {
ASSERT_TRUE(r.Changed());
EXPECT_THAT(r.replacement(),
- IsSelect(kMachNone, IsNumberLessThan(p1, p0), p1, p0));
+ IsSelect(kMachNone, IsNumberLessThan(p1, p0), p0, p1));
} else {
ASSERT_FALSE(r.Changed());
EXPECT_EQ(IrOpcode::kJSCallFunction, call->opcode());
--
--
v8-dev mailing list
[email protected]
http://groups.google.com/group/v8-dev
---
You received this message because you are subscribed to the Google Groups "v8-dev" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
For more options, visit https://groups.google.com/d/optout.
