Skip to content

Commit

Permalink
deps: V8: backport d520ebb
Browse files Browse the repository at this point in the history
Original commit message:

    [turbofan] Fix NumberFloor typing.

    Bug: chromium:841117
    Change-Id: I1e83dfc82f87d0b49d3cca96290ae1d738e37d20
    Reviewed-on: https://chromium-review.googlesource.com/1051228
    Reviewed-by: Benedikt Meurer <[email protected]>
    Commit-Queue: Jaroslav Sevcik <[email protected]>
    Cr-Commit-Position: refs/heads/master@{#53083}

Refs: v8/v8@d520ebb
Fixes: #22810

PR-URL: #27358
Reviewed-By: Ruben Bridgewater <[email protected]>
Reviewed-By: Colin Ihrig <[email protected]>
Reviewed-By: Refael Ackermann (רפאל פלחי) <[email protected]>
Reviewed-By: Anatoli Papirovski <[email protected]>
Reviewed-By: Beth Griggs <[email protected]>
  • Loading branch information
targos authored and BethGriggs committed Sep 19, 2019
1 parent a7e5fe1 commit 37e24b1
Show file tree
Hide file tree
Showing 3 changed files with 17 additions and 5 deletions.
2 changes: 1 addition & 1 deletion deps/v8/include/v8-version.h
Original file line number Diff line number Diff line change
Expand Up @@ -11,7 +11,7 @@
#define V8_MAJOR_VERSION 6
#define V8_MINOR_VERSION 2
#define V8_BUILD_NUMBER 414
#define V8_PATCH_LEVEL 77
#define V8_PATCH_LEVEL 78

// Use 1 for candidates and 0 otherwise.
// (Boolean macro values are not supported by all preprocessors.)
Expand Down
9 changes: 5 additions & 4 deletions deps/v8/src/compiler/typed-optimization.cc
Original file line number Diff line number Diff line change
Expand Up @@ -244,12 +244,13 @@ Reduction TypedOptimization::ReduceNumberFloor(Node* node) {
//
// NumberToUint32(NumberDivide(lhs, rhs))
//
// and just smash the type of the {lhs} on the {node},
// as the truncated result must be in the same range as
// {lhs} since {rhs} cannot be less than 1 (due to the
// and just smash the type [0...lhs.Max] on the {node},
// as the truncated result must be loewr than {lhs}'s maximum
// value (note that {rhs} cannot be less than 1 due to the
// plain-number type constraint on the {node}).
NodeProperties::ChangeOp(node, simplified()->NumberToUint32());
NodeProperties::SetType(node, lhs_type);
NodeProperties::SetType(node,
Type::Range(0, lhs_type->Max(), graph()->zone()));
return Changed(node);
}
}
Expand Down
11 changes: 11 additions & 0 deletions deps/v8/test/mjsunit/compiler/regress-841117.js
Original file line number Diff line number Diff line change
@@ -0,0 +1,11 @@
// Copyright 2018 the V8 project authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.

// Flags: --allow-natives-syntax

var v = 1e9;
function f() { return Math.floor(v / 10); }
assertEquals(1e8, f());
%OptimizeFunctionOnNextCall(f);
assertEquals(1e8, f());

0 comments on commit 37e24b1

Please sign in to comment.