• Jakob Linke's avatar
    [maglev] Deopt on overflow in >>> · 24e60017
    Jakob Linke authored
    Re-enable the int32 fast path for ShiftRightLogical, but account for
    Maglev's missing signed/unsigned representation tracking by a)
    removing rhs==0 as the identity value (a shift by 0 is still a
    signed-unsigned conversion) and b) deoptimizing if the result cannot
    be converted to a non-negative smi.
    
    Note this is not a deopt loop, since a non-smi result will change the
    feedback to kSignedSmallInputs (from kSignedSmall).
    
    To fix this properly, we should track signed/unsigned representations
    and convert the result to a heap number if it doesn't fit within smi
    range.
    
    Bug: v8:7700
    Change-Id: Ifd538d227a6f1290eb7f008d9bfad586ff91ea0f
    Fixed: v8:13251
    Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3876366Reviewed-by: 's avatarLeszek Swirski <leszeks@chromium.org>
    Commit-Queue: Jakob Linke <jgruber@chromium.org>
    Cr-Commit-Position: refs/heads/main@{#83025}
    24e60017
Name
Last commit
Last update
..
00.js Loading commit data...
01.js Loading commit data...
02.js Loading commit data...
03.js Loading commit data...
04.js Loading commit data...
05.js Loading commit data...
06.js Loading commit data...
07.js Loading commit data...
08.js Loading commit data...
09.js Loading commit data...
10.js Loading commit data...
11.js Loading commit data...
12.js Loading commit data...
13.js Loading commit data...
14.js Loading commit data...
15.js Loading commit data...
16.js Loading commit data...
17.js Loading commit data...
18.js Loading commit data...
19.js Loading commit data...
add-number.js Loading commit data...
add-smi.js Loading commit data...
argument-over-under-application.js Loading commit data...
call-js-runtime.js Loading commit data...
call-runtime-for-pair.js Loading commit data...
constant-in-proto-proxy-after-holder.js Loading commit data...
destructuring-assignment-with-exclude-properties.js Loading commit data...
eager-deopt-in-inline.js Loading commit data...
exceptions.js Loading commit data...
get-template-object.js Loading commit data...
inner-function.js Loading commit data...
int32-branch.js Loading commit data...
lazy-deopt-with-onstack-activation.js Loading commit data...
lazy-deopt-without-onstack-activation.js Loading commit data...
lda-global-inside-typeof.js Loading commit data...
lda-global.js Loading commit data...
lda-module-variable-import.mjs Loading commit data...
lda-module-variable.mjs Loading commit data...
literals.js Loading commit data...
load-named.js Loading commit data...
lots-of-registers.js Loading commit data...
mutable-context-access.js Loading commit data...
osr-from-ml-to-tf.js Loading commit data...
osr-to-tf.js Loading commit data...
set-pending-message.js Loading commit data...
shift-right-logical-smi.js Loading commit data...
shift-right-logical.js Loading commit data...
shift-right-smi.js Loading commit data...
shift-right.js Loading commit data...
simple-inlining.js Loading commit data...
spill-double.js Loading commit data...
sta-module-variable.mjs Loading commit data...
string-compare.js Loading commit data...
super-ic.js Loading commit data...
tier-to-ml-to-tf.js Loading commit data...
undefined-or-null-branch.js Loading commit data...