Chromium Code Reviews
chromiumcodereview-hr@appspot.gserviceaccount.com (chromiumcodereview-hr) | Please choose your nickname with Settings | Help | Chromium Project | Gerrit Changes | Sign out
(273)

Side by Side Diff: src/compiler/simplified-lowering.cc

Issue 803483002: [turbofan] Quickfix for invalid number truncation of typed array loads. (Closed) Base URL: https://chromium.googlesource.com/v8/v8.git@master
Patch Set: Created 6 years ago
Use n/p to move between diff chunks; N/P to move between comments. Draft comments are only viewable by you.
Jump to:
View unified diff | Download patch
« no previous file with comments | « no previous file | test/mjsunit/compiler/regress-int32array-outofbounds-nan.js » ('j') | no next file with comments »
Toggle Intra-line Diffs ('i') | Expand Comments ('e') | Collapse Comments ('c') | Show Comments Hide Comments ('s')
OLDNEW
1 // Copyright 2014 the V8 project authors. All rights reserved. 1 // Copyright 2014 the V8 project authors. All rights reserved.
2 // Use of this source code is governed by a BSD-style license that can be 2 // Use of this source code is governed by a BSD-style license that can be
3 // found in the LICENSE file. 3 // found in the LICENSE file.
4 4
5 #include "src/compiler/simplified-lowering.h" 5 #include "src/compiler/simplified-lowering.h"
6 6
7 #include <limits>
8
7 #include "src/base/bits.h" 9 #include "src/base/bits.h"
8 #include "src/code-factory.h" 10 #include "src/code-factory.h"
9 #include "src/compiler/common-operator.h" 11 #include "src/compiler/common-operator.h"
10 #include "src/compiler/diamond.h" 12 #include "src/compiler/diamond.h"
11 #include "src/compiler/graph-inl.h" 13 #include "src/compiler/graph-inl.h"
12 #include "src/compiler/node-matchers.h" 14 #include "src/compiler/node-matchers.h"
13 #include "src/compiler/node-properties-inl.h" 15 #include "src/compiler/node-properties-inl.h"
14 #include "src/compiler/representation-change.h" 16 #include "src/compiler/representation-change.h"
15 #include "src/compiler/simplified-lowering.h" 17 #include "src/compiler/simplified-lowering.h"
16 #include "src/compiler/simplified-operator.h" 18 #include "src/compiler/simplified-operator.h"
(...skipping 740 matching lines...) Expand 10 before | Expand all | Expand 10 after
757 break; 759 break;
758 } 760 }
759 case IrOpcode::kLoadBuffer: { 761 case IrOpcode::kLoadBuffer: {
760 BufferAccess access = BufferAccessOf(node->op()); 762 BufferAccess access = BufferAccessOf(node->op());
761 ProcessInput(node, 0, kMachPtr); // buffer 763 ProcessInput(node, 0, kMachPtr); // buffer
762 ProcessInput(node, 1, kMachInt32); // offset 764 ProcessInput(node, 1, kMachInt32); // offset
763 ProcessInput(node, 2, kMachInt32); // length 765 ProcessInput(node, 2, kMachInt32); // length
764 ProcessRemainingInputs(node, 3); 766 ProcessRemainingInputs(node, 3);
765 // Tagged overrides everything if we have to do a typed array bounds 767 // Tagged overrides everything if we have to do a typed array bounds
766 // check, because we may need to return undefined then. 768 // check, because we may need to return undefined then.
767 MachineType output_type = 769 MachineType output_type;
768 (use & kRepTagged) ? kMachAnyTagged : access.machine_type(); 770 if (use & kRepTagged) {
771 output_type = kMachAnyTagged;
772 } else if (use & kRepFloat64) {
773 if (access.machine_type() & kRepFloat32) {
774 output_type = access.machine_type();
775 } else {
776 output_type = kMachFloat64;
777 }
778 } else if (use & kRepFloat32) {
779 output_type = kMachFloat32;
780 } else {
781 output_type = access.machine_type();
782 }
769 SetOutput(node, output_type); 783 SetOutput(node, output_type);
770 if (lower()) lowering->DoLoadBuffer(node, output_type, changer_); 784 if (lower()) lowering->DoLoadBuffer(node, output_type, changer_);
771 break; 785 break;
772 } 786 }
773 case IrOpcode::kStoreBuffer: { 787 case IrOpcode::kStoreBuffer: {
774 BufferAccess access = BufferAccessOf(node->op()); 788 BufferAccess access = BufferAccessOf(node->op());
775 ProcessInput(node, 0, kMachPtr); // buffer 789 ProcessInput(node, 0, kMachPtr); // buffer
776 ProcessInput(node, 1, kMachInt32); // offset 790 ProcessInput(node, 1, kMachInt32); // offset
777 ProcessInput(node, 2, kMachInt32); // length 791 ProcessInput(node, 2, kMachInt32); // length
778 ProcessInput(node, 3, access.machine_type()); // value 792 ProcessInput(node, 3, access.machine_type()); // value
(...skipping 344 matching lines...) Expand 10 before | Expand all | Expand 10 after
1123 } 1137 }
1124 return index; 1138 return index;
1125 } 1139 }
1126 1140
1127 1141
1128 void SimplifiedLowering::DoLoadBuffer(Node* node, MachineType output_type, 1142 void SimplifiedLowering::DoLoadBuffer(Node* node, MachineType output_type,
1129 RepresentationChanger* changer) { 1143 RepresentationChanger* changer) {
1130 DCHECK_EQ(IrOpcode::kLoadBuffer, node->opcode()); 1144 DCHECK_EQ(IrOpcode::kLoadBuffer, node->opcode());
1131 DCHECK_NE(kMachNone, RepresentationOf(output_type)); 1145 DCHECK_NE(kMachNone, RepresentationOf(output_type));
1132 MachineType const type = BufferAccessOf(node->op()).machine_type(); 1146 MachineType const type = BufferAccessOf(node->op()).machine_type();
1133 if (output_type & kRepTagged) { 1147 if (output_type != type) {
1134 Node* const buffer = node->InputAt(0); 1148 Node* const buffer = node->InputAt(0);
1135 Node* const offset = node->InputAt(1); 1149 Node* const offset = node->InputAt(1);
1136 Node* const length = node->InputAt(2); 1150 Node* const length = node->InputAt(2);
1137 Node* const effect = node->InputAt(3); 1151 Node* const effect = node->InputAt(3);
1138 Node* const control = node->InputAt(4); 1152 Node* const control = node->InputAt(4);
1139 1153
1140 Node* check = graph()->NewNode(machine()->Uint32LessThan(), offset, length); 1154 Node* check = graph()->NewNode(machine()->Uint32LessThan(), offset, length);
1141 Node* branch = 1155 Node* branch =
1142 graph()->NewNode(common()->Branch(BranchHint::kTrue), check, control); 1156 graph()->NewNode(common()->Branch(BranchHint::kTrue), check, control);
1143 1157
1144 Node* if_true = graph()->NewNode(common()->IfTrue(), branch); 1158 Node* if_true = graph()->NewNode(common()->IfTrue(), branch);
1145 Node* etrue = graph()->NewNode(machine()->Load(type), buffer, offset, 1159 Node* etrue = graph()->NewNode(machine()->Load(type), buffer, offset,
1146 effect, if_true); 1160 effect, if_true);
1147 Node* vtrue = changer->GetTaggedRepresentationFor(etrue, type); 1161 Node* vtrue = changer->GetRepresentationFor(etrue, type, output_type);
1148 1162
1149 Node* if_false = graph()->NewNode(common()->IfFalse(), branch); 1163 Node* if_false = graph()->NewNode(common()->IfFalse(), branch);
1150 Node* vfalse = jsgraph()->UndefinedConstant();
1151 Node* efalse = effect; 1164 Node* efalse = effect;
1165 Node* vfalse;
1166 if (output_type & kRepTagged) {
1167 vfalse = jsgraph()->UndefinedConstant();
1168 } else if (output_type & kRepFloat64) {
1169 vfalse =
1170 jsgraph()->Float64Constant(std::numeric_limits<double>::quiet_NaN());
1171 } else if (output_type & kRepFloat32) {
1172 vfalse =
1173 jsgraph()->Float32Constant(std::numeric_limits<float>::quiet_NaN());
1174 } else {
1175 vfalse = jsgraph()->Int32Constant(0);
1176 }
1152 1177
1153 Node* merge = graph()->NewNode(common()->Merge(2), if_true, if_false); 1178 Node* merge = graph()->NewNode(common()->Merge(2), if_true, if_false);
1154 Node* ephi = graph()->NewNode(common()->EffectPhi(2), etrue, efalse, merge); 1179 Node* ephi = graph()->NewNode(common()->EffectPhi(2), etrue, efalse, merge);
1155 1180
1156 // Replace effect uses of {node} with the {ephi}. 1181 // Replace effect uses of {node} with the {ephi}.
1157 NodeProperties::ReplaceWithValue(node, node, ephi); 1182 NodeProperties::ReplaceWithValue(node, node, ephi);
1158 1183
1159 // Turn the {node} into a Phi. 1184 // Turn the {node} into a Phi.
1160 node->set_op(common()->Phi(kMachAnyTagged, 2)); 1185 node->set_op(common()->Phi(output_type, 2));
1161 node->ReplaceInput(0, vtrue); 1186 node->ReplaceInput(0, vtrue);
1162 node->ReplaceInput(1, vfalse); 1187 node->ReplaceInput(1, vfalse);
1163 node->ReplaceInput(2, merge); 1188 node->ReplaceInput(2, merge);
1164 node->TrimInputCount(3); 1189 node->TrimInputCount(3);
1165 } else { 1190 } else {
1166 node->set_op(machine()->CheckedLoad(type)); 1191 node->set_op(machine()->CheckedLoad(type));
1167 } 1192 }
1168 } 1193 }
1169 1194
1170 1195
(...skipping 279 matching lines...) Expand 10 before | Expand all | Expand 10 after
1450 1475
1451 void SimplifiedLowering::DoStringLessThanOrEqual(Node* node) { 1476 void SimplifiedLowering::DoStringLessThanOrEqual(Node* node) {
1452 node->set_op(machine()->IntLessThanOrEqual()); 1477 node->set_op(machine()->IntLessThanOrEqual());
1453 node->ReplaceInput(0, StringComparison(node, true)); 1478 node->ReplaceInput(0, StringComparison(node, true));
1454 node->ReplaceInput(1, jsgraph()->SmiConstant(EQUAL)); 1479 node->ReplaceInput(1, jsgraph()->SmiConstant(EQUAL));
1455 } 1480 }
1456 1481
1457 } // namespace compiler 1482 } // namespace compiler
1458 } // namespace internal 1483 } // namespace internal
1459 } // namespace v8 1484 } // namespace v8
OLDNEW
« no previous file with comments | « no previous file | test/mjsunit/compiler/regress-int32array-outofbounds-nan.js » ('j') | no next file with comments »

Powered by Google App Engine
This is Rietveld 408576698