|
| 1 | +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 |
| 2 | +From: Georg Neis <neis@chromium.org> |
| 3 | +Date: Tue, 24 Nov 2020 14:43:35 +0100 |
| 4 | +Subject: Merged: [compiler] Fix a bug in SimplifiedLowering |
| 5 | + |
| 6 | +Revision: ba1b2cc09ab98b51ca3828d29d19ae3b0a7c3a92 |
| 7 | + |
| 8 | +BUG=chromium:1150649 |
| 9 | +NOTRY=true |
| 10 | +NOPRESUBMIT=true |
| 11 | +NOTREECHECKS=true |
| 12 | +TBR=tebbi@chromium.org |
| 13 | + |
| 14 | +Change-Id: I3600d25ebc255b0e58a7db1ca8d025424f6ad3f5 |
| 15 | +Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2557983 |
| 16 | +Reviewed-by: Georg Neis <neis@chromium.org> |
| 17 | +Commit-Queue: Georg Neis <neis@chromium.org> |
| 18 | +Cr-Commit-Position: refs/branch-heads/8.7@{#55} |
| 19 | +Cr-Branched-From: 0d81cd72688512abcbe1601015baee390c484a6a-refs/heads/8.7.220@{#1} |
| 20 | +Cr-Branched-From: 942c2ef85caef00fcf02517d049f05e9a3d4b440-refs/heads/master@{#70196} |
| 21 | + |
| 22 | +diff --git a/src/compiler/simplified-lowering.cc b/src/compiler/simplified-lowering.cc |
| 23 | +index 40bd28867df24b178896197b5a71f7eeafdacabf..877ed6a0cada424dee0c5050db018f3f7061fc28 100644 |
| 24 | +--- a/src/compiler/simplified-lowering.cc |
| 25 | ++++ b/src/compiler/simplified-lowering.cc |
| 26 | +@@ -1396,7 +1396,6 @@ class RepresentationSelector { |
| 27 | + IsSomePositiveOrderedNumber(input1_type) |
| 28 | + ? CheckForMinusZeroMode::kDontCheckForMinusZero |
| 29 | + : CheckForMinusZeroMode::kCheckForMinusZero; |
| 30 | +- |
| 31 | + NodeProperties::ChangeOp(node, simplified()->CheckedInt32Mul(mz_mode)); |
| 32 | + } |
| 33 | + |
| 34 | +@@ -1439,6 +1438,13 @@ class RepresentationSelector { |
| 35 | + |
| 36 | + Type left_feedback_type = TypeOf(node->InputAt(0)); |
| 37 | + Type right_feedback_type = TypeOf(node->InputAt(1)); |
| 38 | ++ |
| 39 | ++ // Using Signed32 as restriction type amounts to promising there won't be |
| 40 | ++ // signed overflow. This is incompatible with relying on a Word32 |
| 41 | ++ // truncation in order to skip the overflow check. |
| 42 | ++ Type const restriction = |
| 43 | ++ truncation.IsUsedAsWord32() ? Type::Any() : Type::Signed32(); |
| 44 | ++ |
| 45 | + // Handle the case when no int32 checks on inputs are necessary (but |
| 46 | + // an overflow check is needed on the output). Note that we do not |
| 47 | + // have to do any check if at most one side can be minus zero. For |
| 48 | +@@ -1452,7 +1458,7 @@ class RepresentationSelector { |
| 49 | + right_upper.Is(Type::Signed32OrMinusZero()) && |
| 50 | + (left_upper.Is(Type::Signed32()) || right_upper.Is(Type::Signed32()))) { |
| 51 | + VisitBinop(node, UseInfo::TruncatingWord32(), |
| 52 | +- MachineRepresentation::kWord32, Type::Signed32()); |
| 53 | ++ MachineRepresentation::kWord32, restriction); |
| 54 | + } else { |
| 55 | + // If the output's truncation is identify-zeros, we can pass it |
| 56 | + // along. Moreover, if the operation is addition and we know the |
| 57 | +@@ -1472,7 +1478,7 @@ class RepresentationSelector { |
| 58 | + UseInfo right_use = CheckedUseInfoAsWord32FromHint(hint, FeedbackSource(), |
| 59 | + kIdentifyZeros); |
| 60 | + VisitBinop(node, left_use, right_use, MachineRepresentation::kWord32, |
| 61 | +- Type::Signed32()); |
| 62 | ++ restriction); |
| 63 | + } |
| 64 | + if (lower()) { |
| 65 | + if (truncation.IsUsedAsWord32() || |
| 66 | +diff --git a/test/mjsunit/compiler/regress-1150649.js b/test/mjsunit/compiler/regress-1150649.js |
| 67 | +new file mode 100644 |
| 68 | +index 0000000000000000000000000000000000000000..a193481a3a20dc18dab7270a7686f6328bb79538 |
| 69 | +--- /dev/null |
| 70 | ++++ b/test/mjsunit/compiler/regress-1150649.js |
| 71 | +@@ -0,0 +1,24 @@ |
| 72 | ++// Copyright 2020 the V8 project authors. All rights reserved. |
| 73 | ++// Use of this source code is governed by a BSD-style license that can be |
| 74 | ++// found in the LICENSE file. |
| 75 | ++ |
| 76 | ++// Flags: --allow-natives-syntax |
| 77 | ++ |
| 78 | ++function foo(a) { |
| 79 | ++ var y = 0x7fffffff; // 2^31 - 1 |
| 80 | ++ |
| 81 | ++ // Widen the static type of y (this condition never holds). |
| 82 | ++ if (a == NaN) y = NaN; |
| 83 | ++ |
| 84 | ++ // The next condition holds only in the warmup run. It leads to Smi |
| 85 | ++ // (SignedSmall) feedback being collected for the addition below. |
| 86 | ++ if (a) y = -1; |
| 87 | ++ |
| 88 | ++ const z = (y + 1)|0; |
| 89 | ++ return z < 0; |
| 90 | ++} |
| 91 | ++ |
| 92 | ++%PrepareFunctionForOptimization(foo); |
| 93 | ++assertFalse(foo(true)); |
| 94 | ++%OptimizeFunctionOnNextCall(foo); |
| 95 | ++assertTrue(foo(false)); |
0 commit comments