From 4bee89e03c8e9c7259f0882254315a9e8f1c08e8 Mon Sep 17 00:00:00 2001 From: "mstarzinger@chromium.org" Date: Thu, 11 Sep 2014 12:38:16 +0000 Subject: [PATCH] Fix typed lowering of ToBoolean on NaN input. R=rossberg@chromium.org TEST=webkit/convert-nan-to-bool Review URL: https://codereview.chromium.org/565493003 git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@23875 ce2b1a6d-e550-0410-aec6-3dcde31c8c00 --- src/compiler/js-typed-lowering.cc | 24 ++++++++++++------------ src/types.h | 3 ++- test/cctest/compiler/test-js-typed-lowering.cc | 10 +++++----- test/mozilla/mozilla.status | 3 --- test/webkit/webkit.status | 2 -- 5 files changed, 19 insertions(+), 23 deletions(-) diff --git a/src/compiler/js-typed-lowering.cc b/src/compiler/js-typed-lowering.cc index c4e7b2b..8690962 100644 --- a/src/compiler/js-typed-lowering.cc +++ b/src/compiler/js-typed-lowering.cc @@ -416,7 +416,7 @@ Reduction JSTypedLowering::ReduceJSToNumberInput(Node* input) { } Type* input_type = NodeProperties::GetBounds(input).upper; if (input_type->Is(Type::Number())) { - // JSToNumber(number) => x + // JSToNumber(x:number) => x return Changed(input); } if (input_type->Is(Type::Undefined())) { @@ -427,8 +427,8 @@ Reduction JSTypedLowering::ReduceJSToNumberInput(Node* input) { // JSToNumber(null) => #0 return ReplaceWith(jsgraph()->ZeroConstant()); } - // TODO(turbofan): js-typed-lowering of ToNumber(boolean) - // TODO(turbofan): js-typed-lowering of ToNumber(string) + // TODO(turbofan): js-typed-lowering of ToNumber(x:boolean) + // TODO(turbofan): js-typed-lowering of ToNumber(x:string) return NoChange(); } @@ -445,7 +445,7 @@ Reduction JSTypedLowering::ReduceJSToStringInput(Node* input) { } Type* input_type = NodeProperties::GetBounds(input).upper; if (input_type->Is(Type::String())) { - return Changed(input); // JSToString(string) => x + return Changed(input); // JSToString(x:string) => x } if (input_type->Is(Type::Undefined())) { return ReplaceWith(jsgraph()->HeapConstant( @@ -455,8 +455,8 @@ Reduction JSTypedLowering::ReduceJSToStringInput(Node* input) { return ReplaceWith(jsgraph()->HeapConstant( graph()->zone()->isolate()->factory()->null_string())); } - // TODO(turbofan): js-typed-lowering of ToString(boolean) - // TODO(turbofan): js-typed-lowering of ToString(number) + // TODO(turbofan): js-typed-lowering of ToString(x:boolean) + // TODO(turbofan): js-typed-lowering of ToString(x:number) return NoChange(); } @@ -473,7 +473,7 @@ Reduction JSTypedLowering::ReduceJSToBooleanInput(Node* input) { } Type* input_type = NodeProperties::GetBounds(input).upper; if (input_type->Is(Type::Boolean())) { - return Changed(input); // JSToBoolean(boolean) => x + return Changed(input); // JSToBoolean(x:boolean) => x } if (input_type->Is(Type::Undefined())) { // JSToBoolean(undefined) => #false @@ -484,15 +484,15 @@ Reduction JSTypedLowering::ReduceJSToBooleanInput(Node* input) { return ReplaceWith(jsgraph()->FalseConstant()); } if (input_type->Is(Type::DetectableReceiver())) { - // JSToBoolean(detectable) => #true + // JSToBoolean(x:detectable) => #true return ReplaceWith(jsgraph()->TrueConstant()); } if (input_type->Is(Type::Undetectable())) { - // JSToBoolean(undetectable) => #false + // JSToBoolean(x:undetectable) => #false return ReplaceWith(jsgraph()->FalseConstant()); } - if (input_type->Is(Type::Number())) { - // JSToBoolean(number) => BooleanNot(NumberEqual(x, #0)) + if (input_type->Is(Type::OrderedNumber())) { + // JSToBoolean(x:ordered-number) => BooleanNot(NumberEqual(x, #0)) Node* cmp = graph()->NewNode(simplified()->NumberEqual(), input, jsgraph()->ZeroConstant()); Node* inv = graph()->NewNode(simplified()->BooleanNot(), cmp); @@ -629,7 +629,7 @@ Reduction JSTypedLowering::Reduce(Node* node) { Reduction result = ReduceJSToBooleanInput(node->InputAt(0)); Node* value; if (result.Changed()) { - // JSUnaryNot(x) => BooleanNot(x) + // JSUnaryNot(x:boolean) => BooleanNot(x) value = graph()->NewNode(simplified()->BooleanNot(), result.replacement()); NodeProperties::ReplaceWithValue(node, value); diff --git a/src/types.h b/src/types.h index cca8b31..2b77ad7 100644 --- a/src/types.h +++ b/src/types.h @@ -193,7 +193,8 @@ namespace internal { V(Signed32, kSignedSmall | kOtherUnsigned31 | kOtherSigned32) \ V(Unsigned32, kUnsignedSmall | kOtherUnsigned31 | kOtherUnsigned32) \ V(Integral32, kSigned32 | kUnsigned32) \ - V(Number, kIntegral32 | kMinusZero | kNaN | kOtherNumber) \ + V(OrderedNumber, kIntegral32 | kMinusZero | kOtherNumber) \ + V(Number, kOrderedNumber | kNaN) \ V(String, kInternalizedString | kOtherString) \ V(UniqueName, kSymbol | kInternalizedString) \ V(Name, kSymbol | kString) \ diff --git a/test/cctest/compiler/test-js-typed-lowering.cc b/test/cctest/compiler/test-js-typed-lowering.cc index a7ffc67..adb1e62 100644 --- a/test/cctest/compiler/test-js-typed-lowering.cc +++ b/test/cctest/compiler/test-js-typed-lowering.cc @@ -472,12 +472,12 @@ TEST(JSToBoolean) { CHECK_EQ(IrOpcode::kParameter, r->opcode()); } - { // ToBoolean(number) - Node* r = R.ReduceUnop(op, Type::Number()); + { // ToBoolean(ordered-number) + Node* r = R.ReduceUnop(op, Type::OrderedNumber()); CHECK_EQ(IrOpcode::kBooleanNot, r->opcode()); Node* i = r->InputAt(0); CHECK_EQ(IrOpcode::kNumberEqual, i->opcode()); - // ToBoolean(number) => BooleanNot(NumberEqual(x, #0)) + // ToBoolean(x:ordered-number) => BooleanNot(NumberEqual(x, #0)) } { // ToBoolean(string) @@ -507,7 +507,7 @@ TEST(JSToBoolean_replacement) { JSTypedLoweringTester R; Type* types[] = {Type::Null(), Type::Undefined(), - Type::Boolean(), Type::Number(), + Type::Boolean(), Type::OrderedNumber(), Type::DetectableObject(), Type::Undetectable()}; for (size_t i = 0; i < arraysize(types); i++) { @@ -522,7 +522,7 @@ TEST(JSToBoolean_replacement) { if (types[i]->Is(Type::Boolean())) { CHECK_EQ(n, r); - } else if (types[i]->Is(Type::Number())) { + } else if (types[i]->Is(Type::OrderedNumber())) { CHECK_EQ(IrOpcode::kBooleanNot, r->opcode()); } else { CHECK_EQ(IrOpcode::kHeapConstant, r->opcode()); diff --git a/test/mozilla/mozilla.status b/test/mozilla/mozilla.status index 9e8b0af..592f762 100644 --- a/test/mozilla/mozilla.status +++ b/test/mozilla/mozilla.status @@ -63,9 +63,6 @@ # TODO(turbofan): Large switch statements crash. 'js1_5/Regress/regress-398085-01': [PASS, NO_VARIANTS], - # TODO(mstarzinger): Typed lowering screws up ToBoolean somehow. - 'ecma/TypeConversion/9.2': [PASS, NO_VARIANTS], - ##################### SKIPPED TESTS ##################### # This test checks that we behave properly in an out-of-memory diff --git a/test/webkit/webkit.status b/test/webkit/webkit.status index 4f00530..8398b08 100644 --- a/test/webkit/webkit.status +++ b/test/webkit/webkit.status @@ -37,8 +37,6 @@ 'exception-with-handler-inside-eval-with-dynamic-scope': [PASS, NO_VARIANTS], # TODO(turbofan): We run out of stack earlier on 64-bit for now. 'fast/js/deep-recursion-test': [PASS, NO_VARIANTS], - # TODO(mstarzinger): Typed lowering screws up ToBoolean somehow. - 'convert-nan-to-bool': [PASS, NO_VARIANTS], # TODO(mstarzinger): Causes crash in generated code, needs investigation. 'dfg-arguments-osr-exit': [PASS, NO_VARIANTS], 'dfg-arguments-osr-exit-multiple-blocks': [PASS, NO_VARIANTS], -- 2.7.4