• Victor Gomes's avatar
    [maglev] Fix float64 add deoptimization · 5f77a1b3
    Victor Gomes authored
    CheckedFloat64Unbox mutates the input value, but the register allocator
    does not expects this behaviour and propagates a wrong value in the register.
    In particular we deopt with the wrong value if the second Float64Unbox
    in a Float64Add needs to deopt.
    
    This fixes the input value after we convert to double.
    
    Bug: v8:7700
    Change-Id: Ib89573e9f728dc3a34b817fc84f1afcb96f14d18
    Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3610422
    Commit-Queue: Victor Gomes <victorgomes@chromium.org>
    Auto-Submit: Victor Gomes <victorgomes@chromium.org>
    Reviewed-by: 's avatarLeszek Swirski <leszeks@chromium.org>
    Commit-Queue: Leszek Swirski <leszeks@chromium.org>
    Cr-Commit-Position: refs/heads/main@{#80214}
    5f77a1b3
Name
Last commit
Last update
..
00.js Loading commit data...
01.js Loading commit data...
02.js Loading commit data...
03.js Loading commit data...
04.js Loading commit data...
05.js Loading commit data...
06.js Loading commit data...
07.js Loading commit data...
08.js Loading commit data...
09.js Loading commit data...
10.js Loading commit data...
11.js Loading commit data...
12.js Loading commit data...
13.js Loading commit data...
14.js Loading commit data...
15.js Loading commit data...
16.js Loading commit data...
17.js Loading commit data...
18.js Loading commit data...
19.js Loading commit data...
add-number.js Loading commit data...
add-smi.js Loading commit data...
argument-over-under-application.js Loading commit data...
eager-deopt-in-inline.js Loading commit data...
lazy-deopt-with-onstack-activation.js Loading commit data...
lazy-deopt-without-onstack-activation.js Loading commit data...
mutable-context-access.js Loading commit data...
simple-inlining.js Loading commit data...