Author: [email protected]
Date: Wed Jan 7 15:26:31 2009
New Revision: 1042
Added:
branches/bleeding_edge/test/mjsunit/regress/regress-171.js (contents,
props changed)
Modified:
branches/bleeding_edge/src/stub-cache-arm.cc
Log:
Fix for issue 171:
- Make sure to not destroy the instance type by slightly rearranging the
code.
- Added regression test.
Review URL: http://codereview.chromium.org/16594
Modified: branches/bleeding_edge/src/stub-cache-arm.cc
==============================================================================
--- branches/bleeding_edge/src/stub-cache-arm.cc (original)
+++ branches/bleeding_edge/src/stub-cache-arm.cc Wed Jan 7 15:26:31 2009
@@ -312,20 +312,24 @@
}
+// Generate code to load the length from a string object and return the
length.
+// If the receiver object is not a string or a wrapped string object the
+// execution continues at the miss label. The register containing the
+// receiver is potentially clobbered.
void StubCompiler::GenerateLoadStringLength2(MacroAssembler* masm,
Register receiver,
Register scratch1,
Register scratch2,
Label* miss) {
- Label load_length, check_wrapper;
+ Label check_string, check_wrapper;
+ __ bind(&check_string);
// Check if the object is a string leaving the instance type in the
// scratch1 register.
GenerateStringCheck(masm, receiver, scratch1, scratch2,
miss, &check_wrapper);
// Load length directly from the string.
- __ bind(&load_length);
__ and_(scratch1, scratch1, Operand(kStringSizeMask));
__ add(scratch1, scratch1, Operand(String::kHashShift));
__ ldr(r0, FieldMemOperand(receiver, String::kLengthOffset));
@@ -338,11 +342,9 @@
__ cmp(scratch1, Operand(JS_VALUE_TYPE));
__ b(ne, miss);
- // Check if the wrapped value is a string and load the length
- // directly if it is.
- __ ldr(r0, FieldMemOperand(receiver, JSValue::kValueOffset));
- GenerateStringCheck(masm, receiver, scratch1, scratch1, miss, miss);
- __ b(&load_length);
+ // Unwrap the value in place and check if the wrapped value is a string.
+ __ ldr(receiver, FieldMemOperand(receiver, JSValue::kValueOffset));
+ __ b(&check_string);
}
Added: branches/bleeding_edge/test/mjsunit/regress/regress-171.js
==============================================================================
--- (empty file)
+++ branches/bleeding_edge/test/mjsunit/regress/regress-171.js Wed Jan 7
15:26:31 2009
@@ -0,0 +1,41 @@
+// Copyright 2009 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+function f(s) { return s.length; }
+function g(s, key) { return s[key]; }
+
+assertEquals(f(new String("a")), 1);
+assertEquals(f(new String("a")), 1);
+assertEquals(f(new String("a")), 1);
+assertEquals(f("a"), 1);
+assertEquals(f(new String("a")), 1);
+
+assertEquals(g(new String("a"), "length"), 1);
+assertEquals(g(new String("a"), "length"), 1);
+assertEquals(g(new String("a"), "length"), 1);
+assertEquals(g("a", "length"), 1);
+assertEquals(g(new String("a"), "length"), 1);
--~--~---------~--~----~------------~-------~--~----~
v8-dev mailing list
[email protected]
http://groups.google.com/group/v8-dev
-~----------~----~----~----~------~----~------~--~---
