Updates:
Status: Assigned
Owner: [email protected]
Comment #1 on issue 3380 by [email protected]: Bug with x64
http://code.google.com/p/v8/issues/detail?id=3380
This bisects to:
http://build.chromium.org/f/chromium/perf/dashboard/ui/changelog.html?url=/trunk/src&range=271622%3A271630
Making this CL the most likely culprit:
https://codereview.chromium.org/288383002
I found the following reduced repro, which prints "true, true, false" on
all platforms (not just x64), and "true, true, true" with --nocrankshaft:
function foo(a) {
return (a[0] >>> 0) > 0;
}
var a = new Uint32Array([4]);
var b = new Uint32Array([0x80000000]);
print(foo(a));
print(foo(a));
%OptimizeFunctionOnNextCall(foo);
print(foo(b));
I think the bug is that while in HUint32AnalysisPhase::IsSafeUint32Use we
treat HCompareNumericAndBranch as a safe uint32 use, we never set that
compare's kUint32 flag, which the code generator uses to convert the branch
condition to unsigned case. The original proposal,
https://codereview.chromium.org/288853003/diff/1/src/hydrogen.cc line 3573,
performed an extra pass to set that flag.
We might want to revert r21355 until we have a fix. There might be more
than one bug.
--
You received this message because this project is configured to send all
issue notifications to this address.
You may adjust your notification preferences at:
https://code.google.com/hosting/settings
--
--
v8-dev mailing list
[email protected]
http://groups.google.com/group/v8-dev
---
You received this message because you are subscribed to the Google Groups "v8-dev" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
For more options, visit https://groups.google.com/d/optout.
