Reviewers: danno, mvstanton,
Message:
We could force a Smi conversion in optimized code, but I figured making the
runtime function more robust is both easier and the Right Thing to do
anyways.
CQ it if you like it, let's get this into Chromium ASAP!
Description:
Let Runtime_GrowArrayElements accept non-Smi numbers as |key|.
BUG=chromium:485410
LOG=y
[email protected],[email protected]
Please review this at https://codereview.chromium.org/1132113004/
Base URL: https://chromium.googlesource.com/v8/v8.git@master
Affected files (+24, -1 lines):
M src/runtime/runtime-array.cc
A test/mjsunit/regress/regress-crbug-485410.js
Index: src/runtime/runtime-array.cc
diff --git a/src/runtime/runtime-array.cc b/src/runtime/runtime-array.cc
index
95670d5950d55c2b1663213825ee62af1f1d05a3..34f873512506f9fca64dde84fdc21c3ce318aaad
100644
--- a/src/runtime/runtime-array.cc
+++ b/src/runtime/runtime-array.cc
@@ -1223,7 +1223,7 @@ RUNTIME_FUNCTION(Runtime_GrowArrayElements) {
HandleScope scope(isolate);
DCHECK(args.length() == 3);
CONVERT_ARG_HANDLE_CHECKED(JSObject, object, 0);
- CONVERT_SMI_ARG_CHECKED(key, 1);
+ CONVERT_NUMBER_CHECKED(int, key, Int32, args[1]);
if (key < 0) {
return object->elements();
Index: test/mjsunit/regress/regress-crbug-485410.js
diff --git a/test/mjsunit/regress/regress-crbug-485410.js
b/test/mjsunit/regress/regress-crbug-485410.js
new file mode 100644
index
0000000000000000000000000000000000000000..55c9c43dbf8203600fae63ef10302a7162427d96
--- /dev/null
+++ b/test/mjsunit/regress/regress-crbug-485410.js
@@ -0,0 +1,23 @@
+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+var doubles = new Float64Array(1);
+function ToHeapNumber(i) {
+ doubles[0] = i;
+ return doubles[0];
+}
+for (var i = 0; i < 3; i++) ToHeapNumber(i);
+%OptimizeFunctionOnNextCall(ToHeapNumber);
+assertFalse(%IsSmi(ToHeapNumber(1)));
+
+function Fail(a, i, v) {
+ a[i] = v;
+}
+
+for (var i = 0; i < 3; i++) Fail(new Array(1), 1, i);
+%OptimizeFunctionOnNextCall(Fail);
+// 1050 > JSObject::kMaxGap, causing stub failure and runtime call.
+Fail(new Array(1), ToHeapNumber(1050), 3);
--
--
v8-dev mailing list
[email protected]
http://groups.google.com/group/v8-dev
---
You received this message because you are subscribed to the Google Groups "v8-dev" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
For more options, visit https://groups.google.com/d/optout.
