Reviewers: Jakob,
Description:
Revert "[turbofan] Make Factory::NewNumber() always return the
minus_zero_value."
This reverts commit f578d35ba8d6798afe45cd60f4f06bfa7e2ae6be because
(immutable) heap numbers are surprisingly mutable in V8. Someone else
might want to cleanup the mess, otherwise we'll just keep it this way.
[email protected]
BUG=chromium:454894
LOG=y
Please review this at https://codereview.chromium.org/898973003/
Base URL: https://chromium.googlesource.com/v8/v8.git@master
Affected files (+1, -67 lines):
M src/factory.cc
M src/ic/ic.cc
D test/unittests/factory-unittest.cc
M test/unittests/unittests.gyp
Index: test/unittests/factory-unittest.cc
diff --git a/test/unittests/factory-unittest.cc
b/test/unittests/factory-unittest.cc
deleted file mode 100644
index
b090886e105ff3987d257f192dd217a4fdcfbea4..0000000000000000000000000000000000000000
--- a/test/unittests/factory-unittest.cc
+++ /dev/null
@@ -1,52 +0,0 @@
-// Copyright 2015 the V8 project authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#include "src/factory.h"
-#include "src/handles-inl.h"
-#include "test/unittests/test-utils.h"
-#include "testing/gmock-support.h"
-
-using testing::BitEq;
-
-namespace v8 {
-namespace internal {
-
-typedef TestWithIsolate FactoryTest;
-
-
-namespace {
-
-const PretenureFlag kPretenureFlags[] = {TENURED, NOT_TENURED};
-
-} // namespace
-
-
-TEST_F(FactoryTest, MinusZeroValue) {
- Handle<Object> minus_zero_value = factory()->minus_zero_value();
- EXPECT_TRUE(minus_zero_value->IsHeapNumber());
- EXPECT_THAT(minus_zero_value->Number(), BitEq(-0.0));
-}
-
-
-TEST_F(FactoryTest, NewNumberWithMinusZero) {
- Handle<Object> minus_zero_value = factory()->minus_zero_value();
- TRACED_FOREACH(PretenureFlag, pretenure_flag, kPretenureFlags) {
- EXPECT_TRUE(minus_zero_value.is_identical_to(
- factory()->NewNumber(-0.0, pretenure_flag)));
- }
-}
-
-
-TEST_F(FactoryTest, NewHeapNumberWithMinusZero) {
- TRACED_FOREACH(PretenureFlag, pretenure_flag, kPretenureFlags) {
- Handle<Object> value =
- factory()->NewHeapNumber(-0.0, IMMUTABLE, pretenure_flag);
- EXPECT_TRUE(value->IsHeapNumber());
- EXPECT_THAT(value->Number(), BitEq(-0.0));
- EXPECT_FALSE(value.is_identical_to(factory()->minus_zero_value()));
- }
-}
-
-} // namespace internal
-} // namespace v8
Index: src/factory.cc
diff --git a/src/factory.cc b/src/factory.cc
index
3c3021c02164ec688aa7620efa8a02fe21086b55..ce99df2e08cf243716496b06263b07d5d640af04
100644
--- a/src/factory.cc
+++ b/src/factory.cc
@@ -1018,7 +1018,7 @@ Handle<Object> Factory::NewNumber(double value,
// We need to distinguish the minus zero value and this cannot be
// done after conversion to int. Doing this by comparing bit
// patterns is faster than using fpclassify() et al.
- if (IsMinusZero(value)) return minus_zero_value();
+ if (IsMinusZero(value)) return NewHeapNumber(-0.0, IMMUTABLE, pretenure);
int int_value = FastD2IChecked(value);
if (value == int_value && Smi::IsValid(int_value)) {
Index: src/ic/ic.cc
diff --git a/src/ic/ic.cc b/src/ic/ic.cc
index
ccb4f925e6ba8d3adfc9fd2191aeb03290bdfebd..537b18324d6868e29b5a494090f0b4cad59e4e26
100644
--- a/src/ic/ic.cc
+++ b/src/ic/ic.cc
@@ -2508,19 +2508,6 @@ MaybeHandle<Object> BinaryOpIC::Transition(
ASSIGN_RETURN_ON_EXCEPTION(
isolate(), result, Execution::Call(isolate(), function, left, 1,
&right),
Object);
- if (result->IsHeapNumber()) {
- // If the result of this BinaryOpIC is used as left or right hand side
of
- // another binary operation, full-codegen.cc might have decided that
its
- // safe to reuse the double box returned by this BinaryOpIC, but the
builtin
- // above does not know or care about this fact and might return a
canonical
- // value (i.e. the global minus zero constant), which we would then
- // overwrite in the surrounding binary operation. So to be safe, we
need to
- // take a copy of heap numbers here.
- result = isolate()->factory()->NewHeapNumber(result->Number());
- }
- DCHECK(!result.is_identical_to(isolate()->factory()->nan_value()));
- DCHECK(!result.is_identical_to(isolate()->factory()->infinity_value()));
-
DCHECK(!result.is_identical_to(isolate()->factory()->minus_zero_value()));
// Execution::Call can execute arbitrary JavaScript, hence potentially
// update the state of this very IC, so we must update the stored state.
Index: test/unittests/unittests.gyp
diff --git a/test/unittests/unittests.gyp b/test/unittests/unittests.gyp
index
c38999b91728d0dec15bef3515a1de4bdf8c7dd1..86c6ef3ecd767fe8e26ca8f14733001c10bc8e7a
100644
--- a/test/unittests/unittests.gyp
+++ b/test/unittests/unittests.gyp
@@ -75,7 +75,6 @@
'compiler/simplified-operator-unittest.cc',
'compiler/value-numbering-reducer-unittest.cc',
'compiler/zone-pool-unittest.cc',
- 'factory-unittest.cc',
'libplatform/default-platform-unittest.cc',
'libplatform/task-queue-unittest.cc',
'libplatform/worker-thread-unittest.cc',
--
--
v8-dev mailing list
[email protected]
http://groups.google.com/group/v8-dev
---
You received this message because you are subscribed to the Google Groups "v8-dev" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
For more options, visit https://groups.google.com/d/optout.
