deps: V8: cherry-pick 7ae0b77628f6

rayw000 · danielleadams · commit f260bbc0ab08 · 2022-01-31T22:57:50.000-05:00
Original commit message: [interpreter] Stop jump-table optimizing switch stms when spread overflows Bug: v8:12389 Change-Id: I53c728ab0c8ba38c7dd96c7e1089f771ba44b9f0 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3289227 Reviewed-by: Leszek Swirski <leszeks@chromium.org> Commit-Queue: Leszek Swirski <leszeks@chromium.org> Cr-Commit-Position: refs/heads/main@{#77995} Refs: v8/v8@7ae0b77 PR-URL: #40882 Reviewed-By: Michaël Zasso <targos@protonmail.com> Reviewed-By: James M Snell <jasnell@gmail.com>
diff --git a/deps/v8/src/interpreter/bytecode-generator.cc b/deps/v8/src/interpreter/bytecode-generator.cc
@@ -1888,17 +1888,28 @@ bool IsSwitchOptimizable(SwitchStatement* stmt, SwitchInfo* info) {
   }
 
   // GCC also jump-table optimizes switch statements with 6 cases or more.
-  if (!(static_cast<int>(info->covered_cases.size()) >=
-            FLAG_switch_table_min_cases &&
-        IsSpreadAcceptable(info->MaxCase() - info->MinCase(),
-                           cases->length()))) {
-    // Invariant- covered_cases has all cases and only cases that will go in the
-    // jump table.
-    info->covered_cases.clear();
-    return false;
-  } else {
-    return true;
-  }
+  if (static_cast<int>(info->covered_cases.size()) >=
+      FLAG_switch_table_min_cases) {
+    // Due to case spread will be used as the size of jump-table,
+    // we need to check if it doesn't overflow by casting its
+    // min and max bounds to int64_t, and calculate if the difference is less
+    // than or equal to INT_MAX.
+    int64_t min = static_cast<int64_t>(info->MinCase());
+    int64_t max = static_cast<int64_t>(info->MaxCase());
+    int64_t spread = max - min + 1;
+
+    DCHECK_GT(spread, 0);
+
+    // Check if casted spread is acceptable and doesn't overflow.
+    if (spread <= INT_MAX &&
+        IsSpreadAcceptable(static_cast<int>(spread), cases->length())) {
+      return true;
+    }
+  }
+  // Invariant- covered_cases has all cases and only cases that will go in the
+  // jump table.
+  info->covered_cases.clear();
+  return false;
 }
 
 }  // namespace
