• Jakob Linke's avatar
    [maglev] Deopt on overflow in >>> · 24e60017
    Jakob Linke authored
    Re-enable the int32 fast path for ShiftRightLogical, but account for
    Maglev's missing signed/unsigned representation tracking by a)
    removing rhs==0 as the identity value (a shift by 0 is still a
    signed-unsigned conversion) and b) deoptimizing if the result cannot
    be converted to a non-negative smi.
    
    Note this is not a deopt loop, since a non-smi result will change the
    feedback to kSignedSmallInputs (from kSignedSmall).
    
    To fix this properly, we should track signed/unsigned representations
    and convert the result to a heap number if it doesn't fit within smi
    range.
    
    Bug: v8:7700
    Change-Id: Ifd538d227a6f1290eb7f008d9bfad586ff91ea0f
    Fixed: v8:13251
    Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3876366Reviewed-by: 's avatarLeszek Swirski <leszeks@chromium.org>
    Commit-Queue: Jakob Linke <jgruber@chromium.org>
    Cr-Commit-Position: refs/heads/main@{#83025}
    24e60017
maglev-ir.cc 139 KB