Chromium Code Reviews
chromiumcodereview-hr@appspot.gserviceaccount.com (chromiumcodereview-hr) | Please choose your nickname with Settings | Help | Chromium Project | Gerrit Changes | Sign out
(317)

Unified Diff: src/types.h

Issue 739563002: Fix lower bound violation (Closed) Base URL: https://chromium.googlesource.com/v8/v8.git@master
Patch Set: Created 6 years, 1 month ago
Use n/p to move between diff chunks; N/P to move between comments. Draft comments are only viewable by you.
Jump to:
View side-by-side diff with in-line comments
Download patch
« no previous file with comments | « no previous file | test/mjsunit/regress/regress-crbug-433332.js » ('j') | no next file with comments »
Expand Comments ('e') | Collapse Comments ('c') | Show Comments Hide Comments ('s')
Index: src/types.h
diff --git a/src/types.h b/src/types.h
index aafaf07fb5ddc054378ea7a53be68545bb2006ef..f810b3940f0f08400cf2dc4a574aa9342d7b6d2a 100644
--- a/src/types.h
+++ b/src/types.h
@@ -1035,7 +1035,7 @@ struct BoundsImpl {
TypeHandle lower = Type::Union(b1.lower, b2.lower, region);
TypeHandle upper = Type::Intersect(b1.upper, b2.upper, region);
// Lower bounds are considered approximate, correct as necessary.
- lower = Type::Intersect(lower, upper, region);
+ if (!lower->Is(upper)) lower = upper;
return BoundsImpl(lower, upper);
}
@@ -1047,14 +1047,16 @@ struct BoundsImpl {
}
static BoundsImpl NarrowLower(BoundsImpl b, TypeHandle t, Region* region) {
- // Lower bounds are considered approximate, correct as necessary.
- t = Type::Intersect(t, b.upper, region);
TypeHandle lower = Type::Union(b.lower, t, region);
+ // Lower bounds are considered approximate, correct as necessary.
+ if (!lower->Is(b.upper)) lower = b.upper;
return BoundsImpl(lower, b.upper);
}
static BoundsImpl NarrowUpper(BoundsImpl b, TypeHandle t, Region* region) {
- TypeHandle lower = Type::Intersect(b.lower, t, region);
+ TypeHandle lower = b.lower;
TypeHandle upper = Type::Intersect(b.upper, t, region);
+ // Lower bounds are considered approximate, correct as necessary.
+ if (!lower->Is(upper)) lower = upper;
return BoundsImpl(lower, upper);
}
« no previous file with comments | « no previous file | test/mjsunit/regress/regress-crbug-433332.js » ('j') | no next file with comments »

Powered by Google App Engine
This is Rietveld 408576698