From 37e24b19a0c5e3a2112fe816b7476b010303ba0c Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Micha=C3=ABl=20Zasso?= Date: Tue, 23 Apr 2019 14:11:39 +0200 Subject: [PATCH] deps: V8: backport d520ebb MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Original commit message: [turbofan] Fix NumberFloor typing. Bug: chromium:841117 Change-Id: I1e83dfc82f87d0b49d3cca96290ae1d738e37d20 Reviewed-on: https://chromium-review.googlesource.com/1051228 Reviewed-by: Benedikt Meurer Commit-Queue: Jaroslav Sevcik Cr-Commit-Position: refs/heads/master@{#53083} Refs: https://github.com/v8/v8/commit/d520ebb9a85b73b2a6505e133a7cc940c7d2adbd Fixes: https://github.com/nodejs/node/issues/22810 PR-URL: https://github.com/nodejs/node/pull/27358 Reviewed-By: Ruben Bridgewater Reviewed-By: Colin Ihrig Reviewed-By: Refael Ackermann (רפאל פלחי) Reviewed-By: Anatoli Papirovski Reviewed-By: Beth Griggs --- deps/v8/include/v8-version.h | 2 +- deps/v8/src/compiler/typed-optimization.cc | 9 +++++---- deps/v8/test/mjsunit/compiler/regress-841117.js | 11 +++++++++++ 3 files changed, 17 insertions(+), 5 deletions(-) create mode 100644 deps/v8/test/mjsunit/compiler/regress-841117.js diff --git a/deps/v8/include/v8-version.h b/deps/v8/include/v8-version.h index db93e49041c665..8ebfc146b4e87d 100644 --- a/deps/v8/include/v8-version.h +++ b/deps/v8/include/v8-version.h @@ -11,7 +11,7 @@ #define V8_MAJOR_VERSION 6 #define V8_MINOR_VERSION 2 #define V8_BUILD_NUMBER 414 -#define V8_PATCH_LEVEL 77 +#define V8_PATCH_LEVEL 78 // Use 1 for candidates and 0 otherwise. // (Boolean macro values are not supported by all preprocessors.) diff --git a/deps/v8/src/compiler/typed-optimization.cc b/deps/v8/src/compiler/typed-optimization.cc index abb3a2bc50aba4..b4405a10269e01 100644 --- a/deps/v8/src/compiler/typed-optimization.cc +++ b/deps/v8/src/compiler/typed-optimization.cc @@ -244,12 +244,13 @@ Reduction TypedOptimization::ReduceNumberFloor(Node* node) { // // NumberToUint32(NumberDivide(lhs, rhs)) // - // and just smash the type of the {lhs} on the {node}, - // as the truncated result must be in the same range as - // {lhs} since {rhs} cannot be less than 1 (due to the + // and just smash the type [0...lhs.Max] on the {node}, + // as the truncated result must be loewr than {lhs}'s maximum + // value (note that {rhs} cannot be less than 1 due to the // plain-number type constraint on the {node}). NodeProperties::ChangeOp(node, simplified()->NumberToUint32()); - NodeProperties::SetType(node, lhs_type); + NodeProperties::SetType(node, + Type::Range(0, lhs_type->Max(), graph()->zone())); return Changed(node); } } diff --git a/deps/v8/test/mjsunit/compiler/regress-841117.js b/deps/v8/test/mjsunit/compiler/regress-841117.js new file mode 100644 index 00000000000000..a059922a6e6933 --- /dev/null +++ b/deps/v8/test/mjsunit/compiler/regress-841117.js @@ -0,0 +1,11 @@ +// Copyright 2018 the V8 project authors. All rights reserved. +// Use of this source code is governed by a BSD-style license that can be +// found in the LICENSE file. + +// Flags: --allow-natives-syntax + +var v = 1e9; +function f() { return Math.floor(v / 10); } +assertEquals(1e8, f()); +%OptimizeFunctionOnNextCall(f); +assertEquals(1e8, f());