Revision: 5555
Author: [email protected]
Date: Wed Sep 29 09:05:05 2010
Log: Backport r5553 "Do not invoke indexed interceptor getters for negative
indices." to 2.3.
Review URL: http://codereview.chromium.org/3569002
http://code.google.com/p/v8/source/detail?r=5555
Modified:
/branches/2.3/src/arm/ic-arm.cc
/branches/2.3/src/ia32/ic-ia32.cc
/branches/2.3/src/stub-cache.cc
/branches/2.3/src/version.cc
/branches/2.3/src/x64/ic-x64.cc
/branches/2.3/test/cctest/test-api.cc
=======================================
--- /branches/2.3/src/arm/ic-arm.cc Thu Sep 16 03:37:18 2010
+++ /branches/2.3/src/arm/ic-arm.cc Wed Sep 29 09:05:05 2010
@@ -1602,8 +1602,9 @@
// Check that the receiver isn't a smi.
__ BranchOnSmi(r1, &slow);
- // Check that the key is a smi.
- __ BranchOnNotSmi(r0, &slow);
+ // Check that the key is an array index, that is Uint32.
+ __ tst(r0, Operand(kSmiTagMask | kSmiSignMask));
+ __ b(ne, &slow);
// Get the map of the receiver.
__ ldr(r2, FieldMemOperand(r1, HeapObject::kMapOffset));
=======================================
--- /branches/2.3/src/ia32/ic-ia32.cc Thu Sep 16 03:37:18 2010
+++ /branches/2.3/src/ia32/ic-ia32.cc Wed Sep 29 09:05:05 2010
@@ -910,8 +910,8 @@
__ test(edx, Immediate(kSmiTagMask));
__ j(zero, &slow, not_taken);
- // Check that the key is a smi.
- __ test(eax, Immediate(kSmiTagMask));
+ // Check that the key is an array index, that is Uint32.
+ __ test(eax, Immediate(kSmiTagMask | kSmiSignMask));
__ j(not_zero, &slow, not_taken);
// Get the map of the receiver.
=======================================
--- /branches/2.3/src/stub-cache.cc Wed Aug 25 08:26:24 2010
+++ /branches/2.3/src/stub-cache.cc Wed Sep 29 09:05:05 2010
@@ -988,6 +988,7 @@
Object* KeyedLoadPropertyWithInterceptor(Arguments args) {
JSObject* receiver = JSObject::cast(args[0]);
+ ASSERT(Smi::cast(args[1])->value() >= 0);
uint32_t index = Smi::cast(args[1])->value();
return receiver->GetElementWithInterceptor(receiver, index);
}
=======================================
--- /branches/2.3/src/version.cc Tue Sep 28 00:32:12 2010
+++ /branches/2.3/src/version.cc Wed Sep 29 09:05:05 2010
@@ -35,7 +35,7 @@
#define MAJOR_VERSION 2
#define MINOR_VERSION 3
#define BUILD_NUMBER 11
-#define PATCH_LEVEL 15
+#define PATCH_LEVEL 16
#define CANDIDATE_VERSION false
// Define SONAME to have the SCons build the put a specific SONAME into the
=======================================
--- /branches/2.3/src/x64/ic-x64.cc Thu Sep 16 03:37:18 2010
+++ /branches/2.3/src/x64/ic-x64.cc Wed Sep 29 09:05:05 2010
@@ -918,8 +918,8 @@
// Check that the receiver isn't a smi.
__ JumpIfSmi(rdx, &slow);
- // Check that the key is a smi.
- __ JumpIfNotSmi(rax, &slow);
+ // Check that the key is an array index, that is Uint32.
+ __ JumpIfNotPositiveSmi(rax, &slow);
// Get the map of the receiver.
__ movq(rcx, FieldOperand(rdx, HeapObject::kMapOffset));
=======================================
--- /branches/2.3/test/cctest/test-api.cc Mon Sep 27 08:03:50 2010
+++ /branches/2.3/test/cctest/test-api.cc Wed Sep 29 09:05:05 2010
@@ -3060,7 +3060,7 @@
static v8::Handle<Value> IdentityIndexedPropertyGetter(
uint32_t index,
const AccessorInfo& info) {
- return v8::Integer::New(index);
+ return v8::Integer::NewFromUnsigned(index);
}
@@ -3183,6 +3183,45 @@
"}";
ExpectString(code, "PASSED");
}
+
+
+THREADED_TEST(IndexedInterceptorWithNegativeIndices) {
+ v8::HandleScope scope;
+ Local<ObjectTemplate> templ = ObjectTemplate::New();
+ templ->SetIndexedPropertyHandler(IdentityIndexedPropertyGetter);
+
+ LocalContext context;
+ Local<v8::Object> obj = templ->NewInstance();
+ context->Global()->Set(v8_str("obj"), obj);
+
+ const char* code =
+ "try {"
+ " for (var i = 0; i < 100; i++) {"
+ " var expected = i;"
+ " var key = i;"
+ " if (i == 25) {"
+ " key = -1;"
+ " expected = undefined;"
+ " }"
+ " if (i == 50) {"
+ " /* probe minimal Smi number on 32-bit platforms */"
+ " key = -(1 << 30);"
+ " expected = undefined;"
+ " }"
+ " if (i == 75) {"
+ " /* probe minimal Smi number on 64-bit platforms */"
+ " key = 1 << 31;"
+ " expected = undefined;"
+ " }"
+ " var v = obj[key];"
+ " if (v != expected) throw 'Wrong value ' + v + ' at iteration '
+ i;"
+ " }"
+ " 'PASSED'"
+ "} catch(e) {"
+ " e"
+ "}";
+ ExpectString(code, "PASSED");
+}
THREADED_TEST(IndexedInterceptorWithNotSmiLookup) {
@@ -3198,11 +3237,12 @@
"try {"
" for (var i = 0; i < 100; i++) {"
" var expected = i;"
+ " var key = i;"
" if (i == 50) {"
- " i = 'foobar';"
+ " key = 'foobar';"
" expected = undefined;"
" }"
- " var v = obj[i];"
+ " var v = obj[key];"
" if (v != expected) throw 'Wrong value ' + v + ' at iteration '
+ i;"
" }"
" 'PASSED'"
--
v8-dev mailing list
[email protected]
http://groups.google.com/group/v8-dev
