From ff89876bb9d362ea4d53d5ee49346d617ee1f5f6 Mon Sep 17 00:00:00 2001 From: bmeurer Date: Fri, 20 Mar 2015 05:05:06 -0700 Subject: [PATCH] [turbofan] Fix lowering of Math.max for integral inputs. R=jarin@chromium.org BUG=chromium:468162 LOG=y Review URL: https://codereview.chromium.org/1027753002 Cr-Commit-Position: refs/heads/master@{#27341} --- src/compiler/js-builtin-reducer.cc | 4 ++-- test/mjsunit/compiler/regress-468162.js | 11 +++++++++++ test/unittests/compiler/js-builtin-reducer-unittest.cc | 2 +- 3 files changed, 14 insertions(+), 3 deletions(-) create mode 100644 test/mjsunit/compiler/regress-468162.js diff --git a/src/compiler/js-builtin-reducer.cc b/src/compiler/js-builtin-reducer.cc index 2a032db..12b0e2f 100644 --- a/src/compiler/js-builtin-reducer.cc +++ b/src/compiler/js-builtin-reducer.cc @@ -118,8 +118,8 @@ Reduction JSBuiltinReducer::ReduceMathMax(Node* node) { Node* const input = r.GetJSCallInput(i); value = graph()->NewNode( common()->Select(kMachNone), - graph()->NewNode(simplified()->NumberLessThan(), input, value), input, - value); + graph()->NewNode(simplified()->NumberLessThan(), input, value), value, + input); } return Replace(value); } diff --git a/test/mjsunit/compiler/regress-468162.js b/test/mjsunit/compiler/regress-468162.js new file mode 100644 index 0000000..47bff03 --- /dev/null +++ b/test/mjsunit/compiler/regress-468162.js @@ -0,0 +1,11 @@ +// Copyright 2015 the V8 project authors. All rights reserved. +// Use of this source code is governed by a BSD-style license that can be +// found in the LICENSE file. + +var asm = (function() { + "use asm"; + var max = Math.max; + return function f() { return max(0, -17); }; +})(); + +assertEquals(0, asm()); diff --git a/test/unittests/compiler/js-builtin-reducer-unittest.cc b/test/unittests/compiler/js-builtin-reducer-unittest.cc index c98bc6c..5c508a5 100644 --- a/test/unittests/compiler/js-builtin-reducer-unittest.cc +++ b/test/unittests/compiler/js-builtin-reducer-unittest.cc @@ -112,7 +112,7 @@ TEST_F(JSBuiltinReducerTest, MathMax2) { if (t0->Is(Type::Integral32()) && t1->Is(Type::Integral32())) { ASSERT_TRUE(r.Changed()); EXPECT_THAT(r.replacement(), - IsSelect(kMachNone, IsNumberLessThan(p1, p0), p1, p0)); + IsSelect(kMachNone, IsNumberLessThan(p1, p0), p0, p1)); } else { ASSERT_FALSE(r.Changed()); EXPECT_EQ(IrOpcode::kJSCallFunction, call->opcode()); -- 2.7.4