Reviewers: Sven Panne,
Message:
PTAL.
Turns out r14322 unified a bit too much -- even when HMul has int32 inputs
and
only truncating uses, it must do an overflow check because otherwise it
might
return a result that's too precise. Ain't JavaScript lovely? ;-)
Description:
Fix overflow check in mul-i which was missing since r14322
Please review this at https://codereview.chromium.org/14471012/
SVN Base: https://v8.googlecode.com/svn/branches/bleeding_edge
Affected files:
M src/hydrogen-instructions.cc
A + test/mjsunit/regress/regress-mul-canoverflow.js
Index: src/hydrogen-instructions.cc
diff --git a/src/hydrogen-instructions.cc b/src/hydrogen-instructions.cc
index
9c8d9d881d555f18f90c997406327160d2ba8968..d6710a4fa1f43b9311f416c5e5604c46f4322832
100644
--- a/src/hydrogen-instructions.cc
+++ b/src/hydrogen-instructions.cc
@@ -1451,7 +1451,7 @@ HValue* HSub::Canonicalize() {
HValue* HMul::Canonicalize() {
if (IsIdentityOperation(left(), right(), 1)) return left();
if (IsIdentityOperation(right(), left(), 1)) return right();
- return HArithmeticBinaryOperation::Canonicalize();
+ return this;
}
Index: test/mjsunit/regress/regress-mul-canoverflow.js
diff --git a/test/mjsunit/regress/regress-2489.js
b/test/mjsunit/regress/regress-mul-canoverflow.js
similarity index 83%
copy from test/mjsunit/regress/regress-2489.js
copy to test/mjsunit/regress/regress-mul-canoverflow.js
index
882c4f794a88e24d1d64e86a466b27c39f51e625..e3e21caec8f96d118273491d0f34d88b957ecf50
100644
--- a/test/mjsunit/regress/regress-2489.js
+++ b/test/mjsunit/regress/regress-mul-canoverflow.js
@@ -27,24 +27,19 @@
// Flags: --allow-natives-syntax
-"use strict";
-
-function f(a, b) {
- return g("c", "d");
+function boom(a) {
+ return ((a | 0) * (a | 0)) | 0;
}
-
-function g(a, b) {
- g.constructor.apply(this, arguments);
+function boom_unoptimized(a) {
+ try {} catch(_) {}
+ return ((a | 0) * (a | 0)) | 0;
}
-g.constructor = function(a, b) {
- assertEquals("c", a);
- assertEquals("d", b);
-}
+boom(1, 1);
+boom(2, 2);
-f("a", "b");
-f("a", "b");
-%OptimizeFunctionOnNextCall(f);
-f("a", "b");
-g.x = "deopt";
-f("a", "b");
+%OptimizeFunctionOnNextCall(boom);
+var big_int = 0x5F00000F;
+var expected = boom_unoptimized(big_int);
+var actual = boom(big_int)
+assertEquals(expected, actual);
--
--
v8-dev mailing list
[email protected]
http://groups.google.com/group/v8-dev
---
You received this message because you are subscribed to the Google Groups "v8-dev" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
For more options, visit https://groups.google.com/groups/opt_out.
