Reviewers: titzer,
Description:
[turbofan] Fix over-restictive assertion in code generator.
[email protected]
TEST=mjsunit/regress/regress-crbug-489293
BUG=chromium:489293
LOG=n
Please review this at https://codereview.chromium.org/1142873005/
Base URL: https://chromium.googlesource.com/v8/v8.git@master
Affected files (+8, -11 lines):
M src/compiler/code-generator.cc
A + test/mjsunit/regress/regress-crbug-489293.js
Index: src/compiler/code-generator.cc
diff --git a/src/compiler/code-generator.cc b/src/compiler/code-generator.cc
index
152c9a469eb22f0494e5da51ba2caf55b2710b93..4cb3d9474ba6c9cc7b4d31482855a27f70455c95
100644
--- a/src/compiler/code-generator.cc
+++ b/src/compiler/code-generator.cc
@@ -581,10 +581,7 @@ void
CodeGenerator::AddTranslationForOperand(Translation* translation,
isolate()->factory()->NewNumberFromInt(constant.ToInt32());
break;
case Constant::kFloat64:
- DCHECK(type == kMachFloat64 || type == kMachAnyTagged ||
- type == kRepTagged || type == (kTypeNumber | kRepTagged) ||
- type == (kTypeInt32 | kRepTagged) ||
- type == (kTypeUint32 | kRepTagged));
+ DCHECK((type & (kRepFloat64 | kRepTagged)) != 0);
constant_object =
isolate()->factory()->NewNumber(constant.ToFloat64());
break;
case Constant::kHeapObject:
Index: test/mjsunit/regress/regress-crbug-489293.js
diff --git a/test/mjsunit/compiler/regress-468727.js
b/test/mjsunit/regress/regress-crbug-489293.js
similarity index 51%
copy from test/mjsunit/compiler/regress-468727.js
copy to test/mjsunit/regress/regress-crbug-489293.js
index
a69efe5a56552831afe052aa24d1225a87306ab5..38d58e72386951958e7e677e66be0446a427153f
100644
--- a/test/mjsunit/compiler/regress-468727.js
+++ b/test/mjsunit/regress/regress-crbug-489293.js
@@ -2,15 +2,15 @@
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
+// Flags: --allow-natives-syntax --turbo-filter=f --turbo-deoptimization
// Flags: --noanalyze-environment-liveness
function f() {
- var __v_7 = -126 - __v_3;
- var __v_17 = ((__v_15 & __v_14) != 4) | 16;
- if (__v_17) {
- var __v_11 = 1 << __v_7;
+ var x = 0;
+ for (var y = 0; y < 0; ++y) {
+ x = (x + y) | 0;
}
- __v_12 >>= __v_3;
+ return unbound;
}
-
-assertThrows(f);
+%OptimizeFunctionOnNextCall(f);
+assertThrows(f, ReferenceError);
--
--
v8-dev mailing list
[email protected]
http://groups.google.com/group/v8-dev
---
You received this message because you are subscribed to the Google Groups "v8-dev" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
For more options, visit https://groups.google.com/d/optout.
