|
[turbofan] Fix optimized lowering of Math.imul.
We eagerly inserted Int32Mul for Math.imul during builtin lowering and
messed up with the types, which confused the representation selection.
This adds a proper NumberImul operator, and fixes the builtin reducer to
do the right thing according to the spec.
R=mstarzinger@chromium.org
BUG= v8:5006
LOG=n
Committed: https://crrev.com/fa7460adbcc544dcd1483999b553e0cdcab43b51
Cr-Commit-Position: refs/heads/master@{#36219}
|
Unified diffs |
Side-by-side diffs |
Stats (+37 lines, -18 lines) |
 |
M |
src/compiler/js-builtin-reducer.cc
|
View
|
1 chunk |
+7 lines, -5 lines |
0 comments
|
 |
M |
src/compiler/opcodes.h
|
View
|
1 chunk |
+1 line, -0 lines |
0 comments
|
 |
M |
src/compiler/representation-change.cc
|
View
|
1 chunk |
+2 lines, -0 lines |
0 comments
|
 |
M |
src/compiler/simplified-lowering.cc
|
View
|
1 chunk |
+6 lines, -0 lines |
0 comments
|
 |
M |
src/compiler/simplified-operator.h
|
View
|
1 chunk |
+1 line, -0 lines |
0 comments
|
 |
M |
src/compiler/simplified-operator.cc
|
View
|
1 chunk |
+1 line, -0 lines |
0 comments
|
 |
M |
src/compiler/typer.cc
|
View
|
1 chunk |
+2 lines, -0 lines |
0 comments
|
 |
M |
src/compiler/verifier.cc
|
View
|
1 chunk |
+6 lines, -0 lines |
0 comments
|
 |
A + |
test/mjsunit/regress/regress-5006.js
|
View
|
1 chunk |
+4 lines, -10 lines |
0 comments
|
 |
M |
test/unittests/compiler/js-builtin-reducer-unittest.cc
|
View
|
2 chunks |
+4 lines, -3 lines |
0 comments
|
 |
M |
test/unittests/compiler/node-test-utils.h
|
View
|
1 chunk |
+2 lines, -0 lines |
0 comments
|
 |
M |
test/unittests/compiler/node-test-utils.cc
|
View
|
1 chunk |
+1 line, -0 lines |
0 comments
|
Total messages: 13 (5 generated)
|