Reviewers: Toon Verwaest,
Message:
PTAL.
Description:
Fix Math.round/floor that had bogus Smi representation
BUG=chromium:272564
Please review this at https://codereview.chromium.org/23022005/
SVN Base: https://v8.googlecode.com/svn/branches/bleeding_edge
Affected files:
M src/hydrogen-instructions.h
M src/hydrogen-instructions.cc
A + test/mjsunit/regress/regress-crbug-272564.js
Index: src/hydrogen-instructions.cc
diff --git a/src/hydrogen-instructions.cc b/src/hydrogen-instructions.cc
index
1f51b24c74ac6de37f43371fe3271e2a58fc8ef1..a4c54e761e731944247005f0b940df7804617206
100644
--- a/src/hydrogen-instructions.cc
+++ b/src/hydrogen-instructions.cc
@@ -3175,8 +3175,6 @@ Representation
HUnaryMathOperation::RepresentationFromInputs() {
Representation input_rep = value()->representation();
if (!input_rep.IsTagged()) {
rep = rep.generalize(input_rep);
- } else if (flexible_int()) {
- rep = Representation::Integer32();
}
return rep;
}
Index: src/hydrogen-instructions.h
diff --git a/src/hydrogen-instructions.h b/src/hydrogen-instructions.h
index
307ed80415b324c476a0b1fc31806ac488db2b8a..7eae85b519d0206c84d51f74a05945e702b05c59
100644
--- a/src/hydrogen-instructions.h
+++ b/src/hydrogen-instructions.h
@@ -2433,21 +2433,6 @@ class HUnaryMathOperation: public
HTemplateInstruction<2> {
}
}
- virtual void UpdateRepresentation(Representation new_rep,
- HInferRepresentationPhase* h_infer,
- const char* reason) {
- if (flexible_int() && !new_rep.IsSmi()) {
- new_rep = Representation::Integer32();
- }
- HValue::UpdateRepresentation(new_rep, h_infer, reason);
- }
-
- virtual void RepresentationChanged(Representation new_rep) {
- if (flexible_int() && new_rep.IsInteger32()) {
- ClearFlag(kFlexibleRepresentation);
- }
- }
-
virtual Range* InferRange(Zone* zone);
virtual HValue* Canonicalize();
@@ -2465,10 +2450,6 @@ class HUnaryMathOperation: public
HTemplateInstruction<2> {
}
private:
- bool flexible_int() {
- return op_ == kMathFloor || op_ == kMathRound;
- }
-
HUnaryMathOperation(HValue* context, HValue* value, BuiltinFunctionId op)
: HTemplateInstruction<2>(HType::TaggedNumber()), op_(op) {
SetOperandAt(0, context);
@@ -2476,8 +2457,7 @@ class HUnaryMathOperation: public
HTemplateInstruction<2> {
switch (op) {
case kMathFloor:
case kMathRound:
- set_representation(Representation::Smi());
- SetFlag(kFlexibleRepresentation);
+ set_representation(Representation::Integer32());
break;
case kMathAbs:
// Not setting representation here: it is None intentionally.
Index: test/mjsunit/regress/regress-crbug-272564.js
diff --git a/test/mjsunit/regress/regress-2489.js
b/test/mjsunit/regress/regress-crbug-272564.js
similarity index 83%
copy from test/mjsunit/regress/regress-2489.js
copy to test/mjsunit/regress/regress-crbug-272564.js
index
882c4f794a88e24d1d64e86a466b27c39f51e625..5475298a88cde102a1e9229acdf8ec7e73f67c99
100644
--- a/test/mjsunit/regress/regress-2489.js
+++ b/test/mjsunit/regress/regress-crbug-272564.js
@@ -27,24 +27,23 @@
// Flags: --allow-natives-syntax
-"use strict";
-
-function f(a, b) {
- return g("c", "d");
+function Bb(w) {
+ this.width = w;
}
-function g(a, b) {
- g.constructor.apply(this, arguments);
+function ce(a, b) {
+ "number" == typeof a && (a = (b ? Math.round(a) : a) + "px");
+ return a
}
-g.constructor = function(a, b) {
- assertEquals("c", a);
- assertEquals("d", b);
+function pe(a, b, c) {
+ if (b instanceof Bb) b = b.width;
+ a.width = ce(b, !0);
}
-f("a", "b");
-f("a", "b");
-%OptimizeFunctionOnNextCall(f);
-f("a", "b");
-g.x = "deopt";
-f("a", "b");
+var a = new Bb(1);
+var b = new Bb(5);
+pe(a, b, 0);
+pe(a, b, 0);
+%OptimizeFunctionOnNextCall(pe);
+pe(a, b, 0);
--
--
v8-dev mailing list
[email protected]
http://groups.google.com/group/v8-dev
---
You received this message because you are subscribed to the Google Groups "v8-dev" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
For more options, visit https://groups.google.com/groups/opt_out.
