Revision: 5631
Author: [email protected]
Date: Fri Oct 15 07:50:49 2010
Log: Do not return the constant singleton float -0.0 from UnaryOpStub,
because it may be overwritten, on X64 platform.
Review URL: http://codereview.chromium.org/3748007
http://code.google.com/p/v8/source/detail?r=5631
Modified:
/branches/bleeding_edge/src/x64/code-stubs-x64.cc
/branches/bleeding_edge/test/mjsunit/smi-negative-zero.js
=======================================
--- /branches/bleeding_edge/src/x64/code-stubs-x64.cc Thu Sep 30 04:48:03
2010
+++ /branches/bleeding_edge/src/x64/code-stubs-x64.cc Fri Oct 15 07:50:49
2010
@@ -1413,20 +1413,8 @@
__ j(equal, &done);
}
__ SmiNeg(rax, rax, &done);
-
- // Either zero or Smi::kMinValue, neither of which become a smi when
- // negated. We handle negative zero here if required. We always enter
- // the runtime system if we have Smi::kMinValue.
- if (negative_zero_ == kStrictNegativeZero) {
- __ SmiCompare(rax, Smi::FromInt(0));
- __ j(not_equal, &slow);
- __ Move(rax, Factory::minus_zero_value());
- __ jmp(&done);
- } else {
- __ SmiCompare(rax, Smi::FromInt(Smi::kMinValue));
- __ j(equal, &slow);
- __ jmp(&done);
- }
+ __ jmp(&slow); // zero, if not handled above, and Smi::kMinValue.
+
// Try floating point case.
__ bind(&try_float);
} else if (FLAG_debug_code) {
=======================================
--- /branches/bleeding_edge/test/mjsunit/smi-negative-zero.js Thu Oct 8
05:36:12 2009
+++ /branches/bleeding_edge/test/mjsunit/smi-negative-zero.js Fri Oct 15
07:50:49 2010
@@ -98,3 +98,16 @@
assertEquals(-Infinity, one / (-4 % -2), "fiskhest2");
assertEquals(Infinity, one / (4 % 2), "fiskhest3");
assertEquals(Infinity, one / (4 % -2), "fiskhest4");
+
+
+// This tests against a singleton -0.0 object being overwritten.gc
+x = 0;
+z = 3044;
+
+function foo(x) {
+ var y = -x + z;
+ return -x;
+}
+
+assertEquals(0, foo(x));
+assertEquals(0, foo(x));
--
v8-dev mailing list
[email protected]
http://groups.google.com/group/v8-dev
