Reviewers: Sven Panne,
Description:
Merged r13235 into 3.15 branch.
Correctly handle negative codes in String.fromCharCode()
BUG=166553
[email protected]
Please review this at https://chromiumcodereview.appspot.com/11852010/
SVN Base: https://v8.googlecode.com/svn/branches/3.15
Affected files:
M src/string.js
M src/version.cc
A + test/mjsunit/regress/regress-166553.js
Index: src/string.js
diff --git a/src/string.js b/src/string.js
index
badfad353603a9ae2214f806e0cd30911c297521..d9ca035fb5f32983d34bc970fa24867f0acce268
100644
--- a/src/string.js
+++ b/src/string.js
@@ -824,6 +824,7 @@ function StringFromCharCode(code) {
for (i = 0; i < n; i++) {
var code = %_Arguments(i);
if (!%_IsSmi(code)) code = ToNumber(code) & 0xffff;
+ if (code < 0) code = code & 0xffff;
if (code > 0x7f) break;
%_OneByteSeqStringSetChar(one_byte, i, code);
}
Index: src/version.cc
diff --git a/src/version.cc b/src/version.cc
index
aa55c1b86b39ee61d06bcf61bcb5174e6d550030..3901d34c0195555382a7adddb6d827ef493fb748
100644
--- a/src/version.cc
+++ b/src/version.cc
@@ -35,7 +35,7 @@
#define MAJOR_VERSION 3
#define MINOR_VERSION 15
#define BUILD_NUMBER 11
-#define PATCH_LEVEL 5
+#define PATCH_LEVEL 6
// Use 1 for candidates and 0 otherwise.
// (Boolean macro values are not supported by all preprocessors.)
#define IS_CANDIDATE_VERSION 0
Index: test/mjsunit/regress/regress-166553.js
diff --git a/test/mjsunit/elements-length-no-holey.js
b/test/mjsunit/regress/regress-166553.js
similarity index 91%
copy from test/mjsunit/elements-length-no-holey.js
copy to test/mjsunit/regress/regress-166553.js
index
5bac296e1a65f51d9cdfa8406a7c0cb50f937a33..acaf34f4e06011ab5b28e1ce43f79f8fdac5e0aa
100644
--- a/test/mjsunit/elements-length-no-holey.js
+++ b/test/mjsunit/regress/regress-166553.js
@@ -25,9 +25,9 @@
// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
-// Flags: --allow-natives-syntax
+// Flags: --expose_gc
-a = [1,2,3];
-a.length = 1;
-assertFalse(%HasFastHoleyElements(a));
-assertTrue(%HasFastSmiElements(a));
+JSON.stringify(String.fromCharCode(1, -11).toString())
+gc();
+var s = String.fromCharCode(1, -11)
+assertEquals(65525, s.charCodeAt(1))
--
v8-dev mailing list
[email protected]
http://groups.google.com/group/v8-dev
