Skip to content
Permalink
Browse files

[TurboFan] Fix type checks for lowering SpeculativeNumberBinop.

Ensure we only lower SpeculativeNumberBinops to a pure operator for
non-string plain primitives. Previously we could lower if a value might be
the-hole, however this would fail a CHECK in ConvertInputsToNumber which
expects a plain primitive.

BUG=chromium:772420

Change-Id: I0c755d10db7afd9cabfb638eca5662d70dfc8d51
Reviewed-on: https://chromium-review.googlesource.com/715717
Commit-Queue: Ross McIlroy <rmcilroy@chromium.org>
Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#48649}
  • Loading branch information...
rmcilroy authored and Commit Bot committed Oct 17, 2017
1 parent 269b35a commit 3118f473950b4b707d78622053fc4934a2d3f13a
Showing with 31 additions and 1 deletion.
  1. +1 −1 src/compiler/js-typed-lowering.cc
  2. +2 −0 src/compiler/types.h
  3. +28 −0 test/mjsunit/compiler/regress-772420.js
@@ -532,7 +532,7 @@ Reduction JSTypedLowering::ReduceSpeculativeNumberBinop(Node* node) {
NumberOperationHint hint = NumberOperationHintOf(node->op());
if ((hint == NumberOperationHint::kNumber ||
hint == NumberOperationHint::kNumberOrOddball) &&
r.BothInputsAre(Type::NumberOrOddball())) {
r.BothInputsAre(Type::NumberOrUndefinedOrNullOrBoolean())) {
r.ConvertInputsToNumber();
return r.ChangeToPureOperator(r.NumberOpFromSpeculativeNumberOp(),
Type::Number());
@@ -170,6 +170,8 @@ namespace compiler {
kHole) \
V(NumberOrString, kNumber | kString) \
V(NumberOrUndefined, kNumber | kUndefined) \
V(NumberOrUndefinedOrNullOrBoolean, \
kNumber | kNullOrUndefined | kBoolean) \
V(PlainPrimitive, kNumberOrString | kBoolean | \
kNullOrUndefined) \
V(Primitive, kSymbol | kPlainPrimitive) \
@@ -0,0 +1,28 @@
// Copyright 2017 the V8 project authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.

// Flags: --allow-natives-syntax

function foo(arg) {
var value;
// None of the branches of this switch are ever taken, but
// the sequence means value could be the hole.
switch (arg) {
case 1:
let let_var = 1;
case 2:
value = let_var;
}
// Speculative number binop with NumberOrOddball feedback.
// Shouldn't be optimized to pure operator since value's phi
// could theoretically be the hole (we would have already thrown a
// reference error in case 2 above if so, but TF typing still
// thinks it could be the hole).
return value * undefined;
}

foo(3);
foo(3);
%OptimizeFunctionOnNextCall(foo);
foo(3);

0 comments on commit 3118f47

Please sign in to comment.
You can’t perform that action at this time.