Skip to content

Commit

Permalink
deps: V8: cherry-pick 3066b7b2fcb3
Browse files Browse the repository at this point in the history
Original commit message:

    [LTS-M86][compiler][x64] Fix bug in InstructionSelector::ChangeInt32ToInt64

    (cherry picked from commit 02f84c745fc0cae5927a66dc4a3e81334e8f60a6)

    No-Try: true
    No-Presubmit: true
    No-Tree-Checks: true
    Bug: chromium:1196683
    Change-Id: Ib4ea738b47b64edc81450583be4c80a41698c3d1
    Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2820971
    Commit-Queue: Georg Neis <neis@chromium.org>
    Reviewed-by: Nico Hartmann <nicohartmann@chromium.org>
    Cr-Original-Commit-Position: refs/heads/master@{#73903}
    Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2821959
    Commit-Queue: Jana Grill <janagrill@chromium.org>
    Reviewed-by: Georg Neis <neis@chromium.org>
    Reviewed-by: Victor-Gabriel Savu <vsavu@google.com>
    Cr-Commit-Position: refs/branch-heads/8.6@{nodejs#75}
    Cr-Branched-From: a64aed2333abf49e494d2a5ce24bbd14fff19f60-refs/heads/8.6.395@{#1}
    Cr-Branched-From: a626bc036236c9bf92ac7b87dc40c9e538b087e3-refs/heads/master@{#69472}

Refs: v8/v8@3066b7b

PR-URL: nodejs#38275
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
Reviewed-By: Jiawen Geng <technicalcute@gmail.com>
Reviewed-By: Shelley Vohr <codebytere@gmail.com>
  • Loading branch information
targos committed Apr 30, 2021
1 parent 5dc8246 commit 9bfb0f3
Show file tree
Hide file tree
Showing 3 changed files with 60 additions and 2 deletions.
2 changes: 1 addition & 1 deletion common.gypi
Original file line number Diff line number Diff line change
Expand Up @@ -36,7 +36,7 @@

# Reset this number to 0 on major V8 upgrades.
# Increment by one for each non-official patch applied to deps/v8.
'v8_embedder_string': '-node.49',
'v8_embedder_string': '-node.50',

##### V8 defaults for Node.js #####

Expand Down
4 changes: 3 additions & 1 deletion deps/v8/src/compiler/backend/x64/instruction-selector-x64.cc
Original file line number Diff line number Diff line change
Expand Up @@ -1270,7 +1270,9 @@ void InstructionSelector::VisitChangeInt32ToInt64(Node* node) {
opcode = load_rep.IsSigned() ? kX64Movsxwq : kX64Movzxwq;
break;
case MachineRepresentation::kWord32:
opcode = load_rep.IsSigned() ? kX64Movsxlq : kX64Movl;
// ChangeInt32ToInt64 must interpret its input as a _signed_ 32-bit
// integer, so here we must sign-extend the loaded value in any case.
opcode = kX64Movsxlq;
break;
default:
UNREACHABLE();
Expand Down
56 changes: 56 additions & 0 deletions deps/v8/test/mjsunit/compiler/regress-1196683.js
Original file line number Diff line number Diff line change
@@ -0,0 +1,56 @@
// Copyright 2021 the V8 project authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.

// Flags: --allow-natives-syntax


(function() {
const arr = new Uint32Array([2**31]);
function foo() {
return (arr[0] ^ 0) + 1;
}
%PrepareFunctionForOptimization(foo);
assertEquals(-(2**31) + 1, foo());
%OptimizeFunctionOnNextCall(foo);
assertEquals(-(2**31) + 1, foo());
});


// The remaining tests already passed without the bugfix.


(function() {
const arr = new Uint16Array([2**15]);
function foo() {
return (arr[0] ^ 0) + 1;
}
%PrepareFunctionForOptimization(foo);
assertEquals(2**15 + 1, foo());
%OptimizeFunctionOnNextCall(foo);
assertEquals(2**15 + 1, foo());
})();


(function() {
const arr = new Uint8Array([2**7]);
function foo() {
return (arr[0] ^ 0) + 1;
}
%PrepareFunctionForOptimization(foo);
assertEquals(2**7 + 1, foo());
%OptimizeFunctionOnNextCall(foo);
assertEquals(2**7 + 1, foo());
})();


(function() {
const arr = new Int32Array([-(2**31)]);
function foo() {
return (arr[0] >>> 0) + 1;
}
%PrepareFunctionForOptimization(foo);
assertEquals(2**31 + 1, foo());
%OptimizeFunctionOnNextCall(foo);
assertEquals(2**31 + 1, foo());
})();

0 comments on commit 9bfb0f3

Please sign in to comment.