[v8-dev] Version 4.2.77.13 (cherry-pick) (issue 1013853009 by danno@chromium.org)

Wed, 25 Mar 2015 02:53:35 -0700 

Reviewers: titzer,

Description:
Version 4.2.77.13 (cherry-pick)

Merged ff89876bb9d362ea4d53d5ee49346d617ee1f5f6

[turbofan] Fix lowering of Math.max for integral inputs.

BUG=chromium:468162
LOG=N
R=tit...@chromium.org

Please review this at https://codereview.chromium.org/1013853009/

Base URL: https://chromium.googlesource.com/v8/v8.git@4.2

Affected files (+10, -11 lines):
  M include/v8-version.h
  M src/compiler/js-builtin-reducer.cc
  A + test/mjsunit/compiler/regress-468162.js
  M test/unittests/compiler/js-builtin-reducer-unittest.cc


Index: include/v8-version.h
diff --git a/include/v8-version.h b/include/v8-version.h
index 4b71c425887ecf46271c1f827801a56a45db2d11..49f41f0507312618e850f02f71e4f744b0e4ed15 100644 
--- a/include/v8-version.h
+++ b/include/v8-version.h
@@ -11,7 +11,7 @@
 #define V8_MAJOR_VERSION 4
 #define V8_MINOR_VERSION 2
 #define V8_BUILD_NUMBER 77
-#define V8_PATCH_LEVEL 12
+#define V8_PATCH_LEVEL 13

 // Use 1 for candidates and 0 otherwise.
 // (Boolean macro values are not supported by all preprocessors.)
Index: src/compiler/js-builtin-reducer.cc
diff --git a/src/compiler/js-builtin-reducer.cc b/src/compiler/js-builtin-reducer.cc index df43b84c61f783e72c42d683c9a6f33e2831020c..a89f4a32551e8851dee63e44b16f88b1701054b5 100644 
--- a/src/compiler/js-builtin-reducer.cc
+++ b/src/compiler/js-builtin-reducer.cc
@@ -150,8 +150,8 @@ Reduction JSBuiltinReducer::ReduceMathMax(Node* node) {
       Node* const input = r.GetJSCallInput(i);
       value = graph()->NewNode(
           common()->Select(kMachNone),
- graph()->NewNode(simplified()->NumberLessThan(), input, value), input, 
-          value);
+ graph()->NewNode(simplified()->NumberLessThan(), input, value), value, 
+          input);
     }
     return Replace(value);
   }
Index: test/mjsunit/compiler/regress-468162.js
diff --git a/test/mjsunit/regress/regress-crbug-455644.js b/test/mjsunit/compiler/regress-468162.js 
similarity index 57%
copy from test/mjsunit/regress/regress-crbug-455644.js
copy to test/mjsunit/compiler/regress-468162.js
index 4993d857a89f620df2b0d1f9813a2a382a77bd8d..47bff032d584a37824d55dd1881e8a81a258b7e8 100644 
--- a/test/mjsunit/regress/regress-crbug-455644.js
+++ b/test/mjsunit/compiler/regress-468162.js
@@ -2,11 +2,10 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.

-(function f() {
-  do { return 23; } while(false);
-  with (0) {
-    try {
-      return 42;
-    } finally {}
-  }
+var asm = (function() {
+  "use asm";
+  var max = Math.max;
+  return function f() { return max(0, -17); };
 })();
+
+assertEquals(0, asm());
Index: test/unittests/compiler/js-builtin-reducer-unittest.cc
diff --git a/test/unittests/compiler/js-builtin-reducer-unittest.cc b/test/unittests/compiler/js-builtin-reducer-unittest.cc index 1809d40850adcc46fe5f539f261da591046df619..b5c688e147616f68e26d376ce43565d29ea15d78 100644 
--- a/test/unittests/compiler/js-builtin-reducer-unittest.cc
+++ b/test/unittests/compiler/js-builtin-reducer-unittest.cc
@@ -164,7 +164,7 @@ TEST_F(JSBuiltinReducerTest, MathMax2) {
       if (t0->Is(Type::Integral32()) && t1->Is(Type::Integral32())) {
         ASSERT_TRUE(r.Changed());
         EXPECT_THAT(r.replacement(),
-                    IsSelect(kMachNone, IsNumberLessThan(p1, p0), p1, p0));
+                    IsSelect(kMachNone, IsNumberLessThan(p1, p0), p0, p1));
       } else {
         ASSERT_FALSE(r.Changed());
         EXPECT_EQ(IrOpcode::kJSCallFunction, call->opcode());


--
--
v8-dev mailing list
v8-dev@googlegroups.com
http://groups.google.com/group/v8-dev
--- You received this message because you are subscribed to the Google Groups "v8-dev" group. 
To unsubscribe from this group and stop receiving emails from it, send an email 
to v8-dev+unsubscr...@googlegroups.com.
For more options, visit https://groups.google.com/d/optout.

Reply via email to