Missing ToNumber conversion in Crankshaft. |
|||
Issue description
# Minimized program:
print(+({} + 1));
# Compared default with noturbo_opt
# Flags of default:
--abort_on_stack_overflow --expose-gc --allow-natives-syntax --invoke-weak-callbacks --omit-quit --random-seed -284293737
# Flags of noturbo_opt:
--abort_on_stack_overflow --expose-gc --allow-natives-syntax --invoke-weak-callbacks --omit-quit --random-seed -284293737 --always-opt --turbo-filter=~ --noturbo-asm
Difference:
- NaN
+ [object Object]1
### Start of configuration default:
NaN
### End of configuration default
### Start of configuration noturbo_opt:
[object Object]1
### End of configuration noturbo_opt
,
Nov 10 2016
The following revision refers to this bug: https://chromium.googlesource.com/v8/v8.git/+/6d533403f9285e61927300c8a9bc4de00cf467b3 commit 6d533403f9285e61927300c8a9bc4de00cf467b3 Author: bmeurer <bmeurer@chromium.org> Date: Thu Nov 10 13:11:15 2016 [crankshaft] Not all HAdd instructions produce a number. BUG= chromium:664084 R=jarin@chromium.org Review-Url: https://codereview.chromium.org/2494703002 Cr-Commit-Position: refs/heads/master@{#40894} [modify] https://crrev.com/6d533403f9285e61927300c8a9bc4de00cf467b3/src/crankshaft/hydrogen-instructions.h [add] https://crrev.com/6d533403f9285e61927300c8a9bc4de00cf467b3/test/mjsunit/regress/regress-crbug-664084.js
,
Nov 10 2016
,
Dec 13 2016
|
|||
►
Sign in to add a comment |
|||
Comment 1 by bmeu...@chromium.org
, Nov 10 2016Owner: bmeu...@chromium.org
Status: Started (was: Untriaged)
Summary: Missing ToNumber conversion in Crankshaft. (was: Difference between turbofan? and crankshaft: NaN conversion)
Reduces to simple test case: =================================== // Flags: --allow-natives-syntax function foo() { return +({} + 1); } assertEquals(NaN, foo()); assertEquals(NaN, foo()); %OptimizeFunctionOnNextCall(foo); assertEquals(NaN, foo()); =================================== Crankshaft has trouble with ToNumber.