Reviewers: Jakob,

Description:
Fix bug in HPhi::SimplifyConstantInput

[email protected]
BUG=269679

Please review this at https://codereview.chromium.org/23075003/

SVN Base: https://v8.googlecode.com/svn/branches/bleeding_edge

Affected files:
  M src/hydrogen-instructions.h
  M src/hydrogen-instructions.cc
  A + test/mjsunit/regress/regress-phi-truncation.js


Index: src/hydrogen-instructions.cc
diff --git a/src/hydrogen-instructions.cc b/src/hydrogen-instructions.cc
index f74d3a31964da49f36e264134876750a46918f1e..225b080d6e49150e272eddebcafb8e000697461f 100644
--- a/src/hydrogen-instructions.cc
+++ b/src/hydrogen-instructions.cc
@@ -3731,10 +3731,10 @@ void HPhi::SimplifyConstantInputs() {
                          DoubleToInt32(operand->DoubleValue()));
       integer_input->InsertAfter(operand);
       SetOperandAt(i, integer_input);
-    } else if (operand == graph->GetConstantTrue()) {
-      SetOperandAt(i, graph->GetConstant1());
-    } else {
-      // This catches |false|, |undefined|, strings and objects.
+    } else if (operand->HasBooleanValue()) {
+      SetOperandAt(i, operand->BooleanValue() ? graph->GetConstant1()
+                                              : graph->GetConstant0());
+    } else if (operand->ImmortalImmovable()) {
       SetOperandAt(i, graph->GetConstant0());
     }
   }
Index: src/hydrogen-instructions.h
diff --git a/src/hydrogen-instructions.h b/src/hydrogen-instructions.h
index 257233b0f6a87e676b023fe9793e9f310fde83c6..445a5cd0e84f9405d577849c10fbc6165ca2ab58 100644
--- a/src/hydrogen-instructions.h
+++ b/src/hydrogen-instructions.h
@@ -3362,6 +3362,7 @@ class HConstant: public HTemplateInstruction<0> {
     return external_reference_value_;
   }

+  bool HasBooleanValue() const { return type_.IsBoolean(); }
   bool BooleanValue() const { return boolean_value_; }

   virtual intptr_t Hashcode() {
Index: test/mjsunit/regress/regress-phi-truncation.js
diff --git a/test/mjsunit/regress/regress-247688.js b/test/mjsunit/regress/regress-phi-truncation.js
similarity index 63%
copy from test/mjsunit/regress/regress-247688.js
copy to test/mjsunit/regress/regress-phi-truncation.js
index 80e2884c705ef230e96a93ede8e5815175b01363..940efe335731c50f4afd1a9221ecbfc233138821 100644
--- a/test/mjsunit/regress/regress-247688.js
+++ b/test/mjsunit/regress/regress-phi-truncation.js
@@ -27,54 +27,63 @@

 // Flags: --allow-natives-syntax

-var a = {};
-a.x = 1
-a.y = 1.5
+function test(fun, expectation) {
+  assertEquals(1, fun(1));
+  %OptimizeFunctionOnNextCall(fun);
+  assertEquals(expectation, fun(0));
+}

-var b = {}
-b.x = 1.5;
-b.y = 1;
+test(function(x) {
+  var a = x ? true : false;
+  return a | 0;
+}, 0);

-var c = {}
-c.x = 1.5;
+test(function(x) {
+  var a = x ? true : true;
+  return a | 0;
+}, 1);

-var d = {}
-d.x = 1.5;
+test(function(x) {
+  var a = x ? true : "0";
+  return a | 0;
+}, 0);

-var e = {}
-e.x = 1.5;
+test(function(x) {
+  var a = x ? true : "1";
+  return a | 0;
+}, 1);

-var f = {}
-f.x = 1.5;
+test(function(x) {
+  var a = x ? true : "-1";
+  return a | 0;
+}, -1);

-var g = {}
-g.x = 1.5;
+test(function(x) {
+  var a = x ? true : "-0";
+  return a | 0;
+}, 0);

-var h = {}
-h.x = 1.5;
+test(function(x) {
+  var a = x ? true : "0x1234";
+  return a | 0;
+}, 0x1234);

-var i = {}
-i.x = 1.5;
+test(function(x) {
+  var a = x ? true : { valueOf: function() { return 2; } };
+  return a | 0;
+}, 2);

-var o = {}
-var p = {y : 10, z : 1}
-o.__proto__ = p;
-delete p.z
+test(function(x) {
+  var a = x ? true : undefined;
+  return a | 0;
+}, 0);

-function foo(v, w) {
-  // Make load via IC in optimized code. Its target will get overwritten by
-  // lazy deopt patch for the stack check.
-  v.y;
-  // Make store with transition to make this code dependent on the map.
-  w.y = 1;
-  return b.y;
-}
+test(function(x) {
+  var a = x ? true : null;
+  return a | 0;
+}, 0);

-foo(o, c);
-foo(o, d);
-foo(o, e);
-%OptimizeFunctionOnNextCall(foo);
-foo(b, f);
-foo(b, g);
-foo(b, h);
-foo(a, i);
+test(function(x) {
+  var a = x ? true : "";
+  return a | 0;
+}, 0);


--
--
v8-dev mailing list
[email protected]
http://groups.google.com/group/v8-dev
--- You received this message because you are subscribed to the Google Groups "v8-dev" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to [email protected].
For more options, visit https://groups.google.com/groups/opt_out.


Reply via email to