Reviewers: Mads Ager, Description: Fix bug in instanceof stub
If the instanceof stub was requested to deliver true/false objects as the result instead of 0/1 then 0/1 was actually returned if the builtin INSTANCE_OF ended
up being called. This is now fixed. BUG=v8:1020 TEST=test/mjsunit/regress/regress-1020.js Please review this at http://codereview.chromium.org/6014013/ SVN Base: http://v8.googlecode.com/svn/branches/bleeding_edge/ Affected files: M src/ia32/code-stubs-ia32.cc A test/mjsunit/regress/regress-1020.js Index: src/ia32/code-stubs-ia32.cc =================================================================== --- src/ia32/code-stubs-ia32.cc (revision 6179) +++ src/ia32/code-stubs-ia32.cc (working copy) @@ -5164,14 +5164,31 @@ // Slow-case: Go through the JavaScript implementation. __ bind(&slow); - if (HasArgsInRegisters()) { - // Push arguments below return address. - __ pop(scratch); + if (!ReturnTrueFalseObject()) { + // Tail call the builtin which returns 0 or 1. + if (HasArgsInRegisters()) { + // Push arguments below return address. + __ pop(scratch); + __ push(object); + __ push(function); + __ push(scratch); + } + __ InvokeBuiltin(Builtins::INSTANCE_OF, JUMP_FUNCTION); + } else { + // Call the builtin and convert 0/1 to true/false. __ push(object); __ push(function); - __ push(scratch); + __ InvokeBuiltin(Builtins::INSTANCE_OF, CALL_FUNCTION); + NearLabel true_value, done; + __ test(eax, Operand(eax)); + __ j(zero, &true_value); + __ mov(eax, Factory::false_value()); + __ jmp(&done); + __ bind(&true_value); + __ mov(eax, Factory::true_value()); + __ bind(&done); + __ ret((HasArgsInRegisters() ? 0 : 2) * kPointerSize); } - __ InvokeBuiltin(Builtins::INSTANCE_OF, JUMP_FUNCTION); } Index: test/mjsunit/regress/regress-1020.js =================================================================== --- test/mjsunit/regress/regress-1020.js (revision 0) +++ test/mjsunit/regress/regress-1020.js (revision 0) @@ -0,0 +1,32 @@ +// Copyright 2011 the V8 project authors. All rights reserved. +// Redistribution and use in source and binary forms, with or without +// modification, are permitted provided that the following conditions are +// met: +// +// * Redistributions of source code must retain the above copyright +// notice, this list of conditions and the following disclaimer. +// * Redistributions in binary form must reproduce the above +// copyright notice, this list of conditions and the following +// disclaimer in the documentation and/or other materials provided +// with the distribution. +// * Neither the name of Google Inc. nor the names of its +// contributors may be used to endorse or promote products derived +// from this software without specific prior written permission. +// +// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS +// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT +// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR +// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT +// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, +// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT +// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, +// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY +// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT +// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE +// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. + +function isObject(o) { + return o instanceof Object; +} + +assertTrue(isObject(Object)); -- v8-dev mailing list [email protected] http://groups.google.com/group/v8-dev
