Reviewers: Toon Verwaest,
Description:
Enforce correct number comparisons when inlining Array.indexOf.
TEST=mjsunit/regress/regress-crbug-407946
BUG=407946
LOG=y
[email protected]
Please review this at https://codereview.chromium.org/536393003/
SVN Base: https://v8.googlecode.com/svn/branches/bleeding_edge
Affected files (+12, -10 lines):
M src/hydrogen.cc
A + test/mjsunit/regress/regress-crbug-407946.js
Index: src/hydrogen.cc
diff --git a/src/hydrogen.cc b/src/hydrogen.cc
index
c923d2c2f787b16f3e0ec5674f5763731b7cede5..20f86bf5207341ffb1e03f52ff162e053dc16547
100644
--- a/src/hydrogen.cc
+++ b/src/hydrogen.cc
@@ -8808,6 +8808,12 @@ HValue*
HOptimizedGraphBuilder::BuildArrayIndexOf(HValue* receiver,
Push(graph()->GetConstantMinus1());
if (IsFastDoubleElementsKind(kind) || IsFastSmiElementsKind(kind)) {
+ // Make sure that we can actually compare numbers correctly below, see
+ // https://code.google.com/p/chromium/issues/detail?id=407946 for
details.
+ search_element = AddUncasted<HForceRepresentation>(
+ search_element, IsFastSmiElementsKind(kind) ? Representation::Smi()
+ :
Representation::Double());
+
LoopBuilder loop(this, context(), direction);
{
HValue* index = loop.BeginBody(initial, terminating, token);
@@ -8815,12 +8821,8 @@ HValue*
HOptimizedGraphBuilder::BuildArrayIndexOf(HValue* receiver,
elements, index, static_cast<HValue*>(NULL),
kind, ALLOW_RETURN_HOLE);
IfBuilder if_issame(this);
- if (IsFastDoubleElementsKind(kind)) {
- if_issame.If<HCompareNumericAndBranch>(
- element, search_element, Token::EQ_STRICT);
- } else {
- if_issame.If<HCompareObjectEqAndBranch>(element, search_element);
- }
+ if_issame.If<HCompareNumericAndBranch>(element, search_element,
+ Token::EQ_STRICT);
if_issame.Then();
{
Drop(1);
Index: test/mjsunit/regress/regress-crbug-407946.js
diff --git a/test/mjsunit/regress/regress-crbug-380512.js
b/test/mjsunit/regress/regress-crbug-407946.js
similarity index 71%
copy from test/mjsunit/regress/regress-crbug-380512.js
copy to test/mjsunit/regress/regress-crbug-407946.js
index
af78ba7183abebad0178de169592c276f95f03c7..0362a66422ac9e4af1c7c1ce897a35ff4b7c082e
100644
--- a/test/mjsunit/regress/regress-crbug-380512.js
+++ b/test/mjsunit/regress/regress-crbug-407946.js
@@ -4,9 +4,9 @@
// Flags: --allow-natives-syntax
-function f() { [].lastIndexOf(42); }
+function f(n) { return [0].indexOf((n - n) + 0); }
-f();
-f();
+print(f(.1));
+print(f(.1));
%OptimizeFunctionOnNextCall(f);
-f();
+print(f(.1));
--
--
v8-dev mailing list
[email protected]
http://groups.google.com/group/v8-dev
---
You received this message because you are subscribed to the Google Groups "v8-dev" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
For more options, visit https://groups.google.com/d/optout.
