Skip to content

Commit

Permalink
deps: V8: cherry-pick bbc59d124ef3
Browse files Browse the repository at this point in the history
Original commit message:

    M86-LTS: [compiler] Fix bug in RepresentationChanger::GetWord32RepresentationFor

    We have to respect the TypeCheckKind.

    (cherry picked from commit fd29e246f65a7cee130e72cd10f618f3b82af232)

    No-Try: true
    No-Presubmit: true
    No-Tree-Checks: true
    Bug: chromium:1195777
    Change-Id: If1eed719fef79b7c61d99c29ba869ddd7985c413
    Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2817791
    Commit-Queue: Georg Neis <neis@chromium.org>
    Reviewed-by: Nico Hartmann <nicohartmann@chromium.org>
    Cr-Original-Commit-Position: refs/heads/master@{#73909}
    Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2838235
    Owners-Override: Achuith Bhandarkar <achuith@chromium.org>
    Reviewed-by: Artem Sumaneev <asumaneev@google.com>
    Commit-Queue: Achuith Bhandarkar <achuith@chromium.org>
    Cr-Commit-Position: refs/branch-heads/8.6@{nodejs#79}
    Cr-Branched-From: a64aed2333abf49e494d2a5ce24bbd14fff19f60-refs/heads/8.6.395@{#1}
    Cr-Branched-From: a626bc036236c9bf92ac7b87dc40c9e538b087e3-refs/heads/master@{#69472}

Refs: v8/v8@bbc59d1

PR-URL: nodejs#38275
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
Reviewed-By: Jiawen Geng <technicalcute@gmail.com>
Reviewed-By: Shelley Vohr <codebytere@gmail.com>
  • Loading branch information
targos committed Apr 30, 2021
1 parent bda1514 commit 329ee8b
Show file tree
Hide file tree
Showing 3 changed files with 67 additions and 5 deletions.
2 changes: 1 addition & 1 deletion common.gypi
Original file line number Diff line number Diff line change
Expand Up @@ -36,7 +36,7 @@

# Reset this number to 0 on major V8 upgrades.
# Increment by one for each non-official patch applied to deps/v8.
'v8_embedder_string': '-node.59',
'v8_embedder_string': '-node.60',

##### V8 defaults for Node.js #####

Expand Down
8 changes: 4 additions & 4 deletions deps/v8/src/compiler/representation-change.cc
Original file line number Diff line number Diff line change
Expand Up @@ -919,10 +919,10 @@ Node* RepresentationChanger::GetWord32RepresentationFor(
return node;
} else if (output_rep == MachineRepresentation::kWord64) {
if (output_type.Is(Type::Signed32()) ||
output_type.Is(Type::Unsigned32())) {
op = machine()->TruncateInt64ToInt32();
} else if (output_type.Is(cache_->kSafeInteger) &&
use_info.truncation().IsUsedAsWord32()) {
(output_type.Is(Type::Unsigned32()) &&
use_info.type_check() == TypeCheckKind::kNone) ||
(output_type.Is(cache_->kSafeInteger) &&
use_info.truncation().IsUsedAsWord32())) {
op = machine()->TruncateInt64ToInt32();
} else if (use_info.type_check() == TypeCheckKind::kSignedSmall ||
use_info.type_check() == TypeCheckKind::kSigned32 ||
Expand Down
62 changes: 62 additions & 0 deletions deps/v8/test/mjsunit/compiler/regress-1195777.js
Original file line number Diff line number Diff line change
@@ -0,0 +1,62 @@
// Copyright 2021 the V8 project authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.

// Flags: --allow-natives-syntax


(function() {
function foo(b) {
let y = (new Date(42)).getMilliseconds();
let x = -1;
if (b) x = 0xFFFF_FFFF;
return y < Math.max(1 << y, x, 1 + y);
}
assertTrue(foo(true));
%PrepareFunctionForOptimization(foo);
assertTrue(foo(false));
%OptimizeFunctionOnNextCall(foo);
assertTrue(foo(true));
})();


(function() {
function foo(b) {
let x = 0;
if (b) x = -1;
return x == Math.max(-1, x >>> Infinity);
}
assertFalse(foo(true));
%PrepareFunctionForOptimization(foo);
assertTrue(foo(false));
%OptimizeFunctionOnNextCall(foo);
assertFalse(foo(true));
})();


(function() {
function foo(b) {
let x = -1;
if (b) x = 0xFFFF_FFFF;
return -1 < Math.max(0, x, -1);
}
assertTrue(foo(true));
%PrepareFunctionForOptimization(foo);
assertTrue(foo(false));
%OptimizeFunctionOnNextCall(foo);
assertTrue(foo(true));
})();


(function() {
function foo(b) {
let x = 0x7FFF_FFFF;
if (b) x = 0;
return 0 < (Math.max(-5 >>> x, -5) % -5);
}
assertTrue(foo(true));
%PrepareFunctionForOptimization(foo);
assertTrue(foo(false));
%OptimizeFunctionOnNextCall(foo);
assertTrue(foo(true));
})();

0 comments on commit 329ee8b

Please sign in to comment.