Skip to content

Commit

Permalink
deps: upgrade v8 to 4.1.0.27
Browse files Browse the repository at this point in the history
PR-URL: #1289
Reviewed-By: Johan Bergström <bugs@bergstroem.nu>
  • Loading branch information
bnoordhuis committed Mar 27, 2015
1 parent c8fa8cc commit 318d9d8
Show file tree
Hide file tree
Showing 6 changed files with 52 additions and 5 deletions.
2 changes: 1 addition & 1 deletion deps/v8/include/v8-version.h
Original file line number Diff line number Diff line change
Expand Up @@ -11,7 +11,7 @@
#define V8_MAJOR_VERSION 4
#define V8_MINOR_VERSION 1
#define V8_BUILD_NUMBER 0
#define V8_PATCH_LEVEL 25
#define V8_PATCH_LEVEL 27

// Use 1 for candidates and 0 otherwise.
// (Boolean macro values are not supported by all preprocessors.)
Expand Down
4 changes: 2 additions & 2 deletions deps/v8/src/compiler/js-builtin-reducer.cc
Original file line number Diff line number Diff line change
Expand Up @@ -151,8 +151,8 @@ Reduction JSBuiltinReducer::ReduceMathMax(Node* node) {
Node* const input = r.GetJSCallInput(i);
value = graph()->NewNode(
common()->Select(kMachNone),
graph()->NewNode(simplified()->NumberLessThan(), input, value), input,
value);
graph()->NewNode(simplified()->NumberLessThan(), input, value), value,
input);
}
return Replace(value);
}
Expand Down
3 changes: 2 additions & 1 deletion deps/v8/src/hydrogen-bce.cc
Original file line number Diff line number Diff line change
Expand Up @@ -56,7 +56,8 @@ class BoundsCheckKey : public ZoneObject {
constant = HConstant::cast(check->index());
}

if (constant != NULL && constant->HasInteger32Value()) {
if (constant != NULL && constant->HasInteger32Value() &&
constant->Integer32Value() != kMinInt) {
*offset = is_sub ? - constant->Integer32Value()
: constant->Integer32Value();
} else {
Expand Down
11 changes: 11 additions & 0 deletions deps/v8/test/mjsunit/compiler/regress-468162.js
Original file line number Diff line number Diff line change
@@ -0,0 +1,11 @@
// Copyright 2015 the V8 project authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.

var asm = (function() {
"use asm";
var max = Math.max;
return function f() { return max(0, -17); };
})();

assertEquals(0, asm());
35 changes: 35 additions & 0 deletions deps/v8/test/mjsunit/regress/regress-bce-underflow.js
Original file line number Diff line number Diff line change
@@ -0,0 +1,35 @@
// Copyright 2015 the V8 project authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.

// Flags: --allow-natives-syntax

function f(a, i, bool) {
var result;
if (bool) {
// Make sure i - -0x80000000 doesn't overflow in BCE, missing a check for
// x-0 later on.
result = f2(a, 0x7fffffff, i, i, -0x80000000);
} else {
result = f2(a, -3, 4, i, 0);
}
return result;
}

function f2(a, c, x, i, d) {
return a[x + c] + a[x - 0] + a[i - d];
}


var a = [];
var i = 0;
a.push(i++);
a.push(i++);
a.push(i++);
a.push(i++);
a.push(i++);
f(a, 0, false);
f(a, 0, false);
f(a, 0, false);
%OptimizeFunctionOnNextCall(f);
%DebugPrint(f(a, -0x7fffffff, true));
Original file line number Diff line number Diff line change
Expand Up @@ -166,7 +166,7 @@ TEST_F(JSBuiltinReducerTest, MathMax2) {
if (t0->Is(Type::Integral32()) && t1->Is(Type::Integral32())) {
ASSERT_TRUE(r.Changed());
EXPECT_THAT(r.replacement(),
IsSelect(kMachNone, IsNumberLessThan(p1, p0), p1, p0));
IsSelect(kMachNone, IsNumberLessThan(p1, p0), p0, p1));
} else {
ASSERT_FALSE(r.Changed());
EXPECT_EQ(IrOpcode::kJSCallFunction, call->opcode());
Expand Down

0 comments on commit 318d9d8

Please sign in to comment.