Status: Accepted
Owner: [email protected]
Labels: Type-Bug Priority-Medium
New issue 2133 by [email protected]: INT32 case of MUL BinaryOpStub does
not transition on -0 result
http://code.google.com/p/v8/issues/detail?id=2133
This causes hydrogen to erroneously select integer multiplication even
after we deoptimize once on minus zero check:
function mul (a, b) {
return a * b;
}
mul(-1, -1);
mul(0x80000001|0, -1);
mul(0x80000001|0, -1);
%OptimizeFunctionOnNextCall(mul);
mul(0, -1);
%OptimizeFunctionOnNextCall(mul);
mul(0, -1);
[BinaryOpIC (Uninitialized->(SMI->Uninitialized))#MUL]
[BinaryOpIC (SMI->(Int32s->Uninitialized))#MUL]
**** DEOPT: mul at bailout #1, address 0x0, frame size 0
;;; @20: mul-i.
[deoptimizing: begin 0x5483b639 mul @1]
translating mul => node=3, height=0
0xbffff110: [top + 24] <- 0x5483a2e5 ; [esp + 24] 0x5483a2e5 <JS Global
Object>
0xbffff10c: [top + 20] <- 0x00000000 ; [esp + 20] 0
0xbffff108: [top + 16] <- 0xfffffffe ; [esp + 16] -1
0xbffff104: [top + 12] <- 0x57528ebe ; caller's pc
0xbffff100: [top + 8] <- 0xbffff120 ; caller's fp
0xbffff0fc: [top + 4] <- 0x54c08081 ; context
0xbffff0f8: [top + 0] <- 0x5483b639 ; function
[deoptimizing: end 0x5483b639 mul => node=3, pc=0x57528fe5,
state=NO_REGISTERS, took 0.113 ms]
[removing optimized code for: mul]
[optimizing: mul / 5483b639 - took 2.429 ms]
**** DEOPT: mul at bailout #1, address 0x0, frame size 0
;;; @20: mul-i.
[deoptimizing: begin 0x5483b639 mul @1]
translating mul => node=3, height=0
0xbffff110: [top + 24] <- 0x5483a2e5 ; [esp + 24] 0x5483a2e5 <JS Global
Object>
0xbffff10c: [top + 20] <- 0x00000000 ; [esp + 20] 0
0xbffff108: [top + 16] <- 0xfffffffe ; [esp + 16] -1
0xbffff104: [top + 12] <- 0x57528eef ; caller's pc
0xbffff100: [top + 8] <- 0xbffff120 ; caller's fp
0xbffff0fc: [top + 4] <- 0x54c08081 ; context
0xbffff0f8: [top + 0] <- 0x5483b639 ; function
[deoptimizing: end 0x5483b639 mul => node=3, pc=0x57528fe5,
state=NO_REGISTERS, took 0.119 ms]
[removing optimized code for: mul]
--
v8-dev mailing list
[email protected]
http://groups.google.com/group/v8-dev
