Revision: 23819
Author: [email protected]
Date: Wed Sep 10 07:06:32 2014 UTC
Log: Version 3.27.34.18 (merged r23691)
Enforce correct number comparisons when inlining Array.indexOf.
BUG=407946
LOG=N
[email protected]
Review URL: https://codereview.chromium.org/551393004
https://code.google.com/p/v8/source/detail?r=23819
Added:
/branches/3.27/test/mjsunit/regress/regress-crbug-407946.js
Modified:
/branches/3.27/src/hydrogen.cc
/branches/3.27/src/version.cc
=======================================
--- /dev/null
+++ /branches/3.27/test/mjsunit/regress/regress-crbug-407946.js Wed Sep 10
07:06:32 2014 UTC
@@ -0,0 +1,12 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function f(n) { return [0].indexOf((n - n) + 0); }
+
+assertEquals(0, f(.1));
+assertEquals(0, f(.1));
+%OptimizeFunctionOnNextCall(f);
+assertEquals(0, f(.1));
=======================================
--- /branches/3.27/src/hydrogen.cc Thu Jul 31 08:35:41 2014 UTC
+++ /branches/3.27/src/hydrogen.cc Wed Sep 10 07:06:32 2014 UTC
@@ -8674,6 +8674,12 @@
Push(graph()->GetConstantMinus1());
if (IsFastDoubleElementsKind(kind) || IsFastSmiElementsKind(kind)) {
+ // Make sure that we can actually compare numbers correctly below, see
+ // https://code.google.com/p/chromium/issues/detail?id=407946 for
details.
+ search_element = AddUncasted<HForceRepresentation>(
+ search_element, IsFastSmiElementsKind(kind) ? Representation::Smi()
+ :
Representation::Double());
+
LoopBuilder loop(this, context(), direction);
{
HValue* index = loop.BeginBody(initial, terminating, token);
@@ -8681,12 +8687,8 @@
elements, index, static_cast<HValue*>(NULL),
kind, ALLOW_RETURN_HOLE);
IfBuilder if_issame(this);
- if (IsFastDoubleElementsKind(kind)) {
- if_issame.If<HCompareNumericAndBranch>(
- element, search_element, Token::EQ_STRICT);
- } else {
- if_issame.If<HCompareObjectEqAndBranch>(element, search_element);
- }
+ if_issame.If<HCompareNumericAndBranch>(element, search_element,
+ Token::EQ_STRICT);
if_issame.Then();
{
Drop(1);
=======================================
--- /branches/3.27/src/version.cc Wed Sep 3 12:06:53 2014 UTC
+++ /branches/3.27/src/version.cc Wed Sep 10 07:06:32 2014 UTC
@@ -35,7 +35,7 @@
#define MAJOR_VERSION 3
#define MINOR_VERSION 27
#define BUILD_NUMBER 34
-#define PATCH_LEVEL 17
+#define PATCH_LEVEL 18
// Use 1 for candidates and 0 otherwise.
// (Boolean macro values are not supported by all preprocessors.)
#define IS_CANDIDATE_VERSION 0
--
--
v8-dev mailing list
[email protected]
http://groups.google.com/group/v8-dev
---
You received this message because you are subscribed to the Google Groups "v8-dev" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
For more options, visit https://groups.google.com/d/optout.
