[v8-dev] Version 4.1.0.27 (cherry-pick) (issue 1002353003 by danno@chromium.org)

Wed, 25 Mar 2015 05:06:10 -0700 

Reviewers: titzer,

Description:
Version 4.1.0.27 (cherry-pick)

Merged ff89876bb9d362ea4d53d5ee49346d617ee1f5f6

[turbofan] Fix lowering of Math.max for integral inputs.

BUG=chromium:468162
LOG=N
TBR=tit...@chromium.org

Please review this at https://codereview.chromium.org/1002353003/

Base URL: https://chromium.googlesource.com/v8/v8.git@4.1

Affected files (+10, -11 lines):
  M include/v8-version.h
  M src/compiler/js-builtin-reducer.cc
  A + test/mjsunit/compiler/regress-468162.js
  M test/unittests/compiler/js-builtin-reducer-unittest.cc


Index: include/v8-version.h
diff --git a/include/v8-version.h b/include/v8-version.h
index bea92a3b84277ec12481614f906cc60d9a19df48..61ee03872d2308fe4b2a2c6c42762a0cf879ce1f 100644 
--- a/include/v8-version.h
+++ b/include/v8-version.h
@@ -11,7 +11,7 @@
 #define V8_MAJOR_VERSION 4
 #define V8_MINOR_VERSION 1
 #define V8_BUILD_NUMBER 0
-#define V8_PATCH_LEVEL 26
+#define V8_PATCH_LEVEL 27

 // Use 1 for candidates and 0 otherwise.
 // (Boolean macro values are not supported by all preprocessors.)
Index: src/compiler/js-builtin-reducer.cc
diff --git a/src/compiler/js-builtin-reducer.cc b/src/compiler/js-builtin-reducer.cc index 263b0feedda04949e0f83843996da6a51eea86d4..ff9f7b452326d1fd95bc5628cedc63c61ac2531a 100644 
--- a/src/compiler/js-builtin-reducer.cc
+++ b/src/compiler/js-builtin-reducer.cc
@@ -151,8 +151,8 @@ Reduction JSBuiltinReducer::ReduceMathMax(Node* node) {
       Node* const input = r.GetJSCallInput(i);
       value = graph()->NewNode(
           common()->Select(kMachNone),
- graph()->NewNode(simplified()->NumberLessThan(), input, value), input, 
-          value);
+ graph()->NewNode(simplified()->NumberLessThan(), input, value), value, 
+          input);
     }
     return Replace(value);
   }
Index: test/mjsunit/compiler/regress-468162.js
diff --git a/test/mjsunit/compiler/regress-445876.js b/test/mjsunit/compiler/regress-468162.js 
similarity index 55%
copy from test/mjsunit/compiler/regress-445876.js
copy to test/mjsunit/compiler/regress-468162.js
index 30e10e56c3ac424fb8843b700bec2af5ded334ac..47bff032d584a37824d55dd1881e8a81a258b7e8 100644 
--- a/test/mjsunit/compiler/regress-445876.js
+++ b/test/mjsunit/compiler/regress-468162.js
@@ -2,11 +2,10 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.

-// Flags: --allow-natives-syntax
+var asm = (function() {
+  "use asm";
+  var max = Math.max;
+  return function f() { return max(0, -17); };
+})();

-function f(x) {
-  while (1) { s++; }
-  while (x) { s++; }
-}
-
-assertThrows(function () { f(1); });
+assertEquals(0, asm());
Index: test/unittests/compiler/js-builtin-reducer-unittest.cc
diff --git a/test/unittests/compiler/js-builtin-reducer-unittest.cc b/test/unittests/compiler/js-builtin-reducer-unittest.cc index 9c572820e7131e475370c3e31110aa28ad502938..eeb401373f250feee64fc546ffd72cacb8424f7a 100644 
--- a/test/unittests/compiler/js-builtin-reducer-unittest.cc
+++ b/test/unittests/compiler/js-builtin-reducer-unittest.cc
@@ -166,7 +166,7 @@ TEST_F(JSBuiltinReducerTest, MathMax2) {
       if (t0->Is(Type::Integral32()) && t1->Is(Type::Integral32())) {
         ASSERT_TRUE(r.Changed());
         EXPECT_THAT(r.replacement(),
-                    IsSelect(kMachNone, IsNumberLessThan(p1, p0), p1, p0));
+                    IsSelect(kMachNone, IsNumberLessThan(p1, p0), p0, p1));
       } else {
         ASSERT_FALSE(r.Changed());
         EXPECT_EQ(IrOpcode::kJSCallFunction, call->opcode());


--
--
v8-dev mailing list
v8-dev@googlegroups.com
http://groups.google.com/group/v8-dev
--- You received this message because you are subscribed to the Google Groups "v8-dev" group. 
To unsubscribe from this group and stop receiving emails from it, send an email 
to v8-dev+unsubscr...@googlegroups.com.
For more options, visit https://groups.google.com/d/optout.

Reply via email to