Reviewers: Michael Starzinger,
Message:
PTAL.
Description:
Fix NegateCompareOp and InvertCompareOp
BUG=v8:2537
Please review this at https://codereview.chromium.org/12217136/
SVN Base: https://v8.googlecode.com/svn/branches/bleeding_edge
Affected files:
M src/token.h
A + test/mjsunit/regress/regress-2537.js
Index: src/token.h
diff --git a/src/token.h b/src/token.h
index
863ba6285760d4f8a015b9d22dab7962584aecf0..f46f496e566b13ebddc4e55daf424beeb4ba7401
100644
--- a/src/token.h
+++ b/src/token.h
@@ -230,6 +230,7 @@ class Token {
case EQ: return NE;
case NE: return EQ;
case EQ_STRICT: return NE_STRICT;
+ case NE_STRICT: return EQ_STRICT;
case LT: return GTE;
case GT: return LTE;
case LTE: return GT;
@@ -242,9 +243,10 @@ class Token {
static Value InvertCompareOp(Value op) {
ASSERT(IsCompareOp(op));
switch (op) {
- case EQ: return NE;
- case NE: return EQ;
- case EQ_STRICT: return NE_STRICT;
+ case EQ: return EQ;
+ case NE: return NE;
+ case EQ_STRICT: return EQ_STRICT;
+ case NE_STRICT: return NE_STRICT;
case LT: return GT;
case GT: return LT;
case LTE: return GTE;
Index: test/mjsunit/regress/regress-2537.js
diff --git a/test/mjsunit/regress/regress-171641.js
b/test/mjsunit/regress/regress-2537.js
similarity index 81%
copy from test/mjsunit/regress/regress-171641.js
copy to test/mjsunit/regress/regress-2537.js
index
8db6781821325f8f6253eb2df4abb2b362b001c0..c6b5af949055daefaabea64c1c11e775af324da3
100644
--- a/test/mjsunit/regress/regress-171641.js
+++ b/test/mjsunit/regress/regress-2537.js
@@ -27,14 +27,19 @@
// Flags: --allow-natives-syntax
-function foo(k, p) {
- for (var i = 0; i < 1; i++) {
- p = Math.min(p, i);
+var large_int = 0x40000000;
+
+function foo(x, expected) {
+ assertEquals(expected, x); // This succeeds.
+ x += 0; // Force int32 representation so that CompareIDAndBranch is
used.
+ if (3 != x) {
+ x += 0; // Poor man's "iDef".
+ // Fails due to Smi-tagging without overflow check.
+ assertEquals(expected, x);
}
- m = Math.floor((k | 0) / p);
}
-foo(0, 1);
-foo(0, 1);
+foo(1, 1);
+foo(3, 3);
%OptimizeFunctionOnNextCall(foo);
-foo(0, 1);
+foo(large_int, large_int);
--
--
v8-dev mailing list
[email protected]
http://groups.google.com/group/v8-dev
---
You received this message because you are subscribed to the Google Groups "v8-dev" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
For more options, visit https://groups.google.com/groups/opt_out.
