Reviewers: Yang,
Message:
PTAL
Description:
Fix invalid assertion with OSR in BuildBinaryOperation.
BUG=v8:3032
LOG=n
Please review this at https://codereview.chromium.org/98623004/
SVN Base: https://v8.googlecode.com/svn/branches/bleeding_edge
Affected files (+7, -3 lines):
M src/hydrogen.cc
A + test/mjsunit/regress/regress-3032.js
Index: src/hydrogen.cc
diff --git a/src/hydrogen.cc b/src/hydrogen.cc
index
76c5ca0a4df7835fcf4489500c7f5afd229ee54f..900e07ecdf9fa68a32540fc76be401d0b064a343
100644
--- a/src/hydrogen.cc
+++ b/src/hydrogen.cc
@@ -8858,8 +8858,10 @@ HValue* HGraphBuilder::BuildBinaryOperation(
case Token::MOD: {
if (fixed_right_arg.has_value) {
if (right->IsConstant()) {
- ASSERT_EQ(fixed_right_arg.value,
- HConstant::cast(right)->Integer32Value());
+ HConstant* c_right = HConstant::cast(right);
+ if (c_right->HasInteger32Value()) {
+ ASSERT_EQ(fixed_right_arg.value, c_right->Integer32Value());
+ }
} else {
HConstant* fixed_right = Add<HConstant>(
static_cast<int>(fixed_right_arg.value));
Index: test/mjsunit/regress/regress-3032.js
diff --git a/test/mjsunit/regress/regress-2690.js
b/test/mjsunit/regress/regress-3032.js
old mode 100644
new mode 100755
similarity index 95%
copy from test/mjsunit/regress/regress-2690.js
copy to test/mjsunit/regress/regress-3032.js
index
0ed4c5c679a61e0fdb91cd0758b1246aa8f36565..ae545437586a68dd78866177f489975ecff11031
--- a/test/mjsunit/regress/regress-2690.js
+++ b/test/mjsunit/regress/regress-3032.js
@@ -25,4 +25,6 @@
// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
-assertTrue(/\1[a]/.test("\1a"));
+for (var i = 0; i < 1000000; i++) { }
+var xl = 4096;
+var z = i % xl;
--
--
v8-dev mailing list
[email protected]
http://groups.google.com/group/v8-dev
---
You received this message because you are subscribed to the Google Groups "v8-dev" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
For more options, visit https://groups.google.com/groups/opt_out.
