Reviewers: Jakob,
Description:
Merged r14638 into trunk branch.
Fix missing hole check for loads from Smi arrays when all uses are changes
BUG=chromium:233737
[email protected]
Please review this at https://codereview.chromium.org/15011010/
SVN Base: https://v8.googlecode.com/svn/trunk
Affected files:
M src/hydrogen-instructions.h
M src/version.cc
A + test/mjsunit/regress/regress-crbug-233737.js
Index: src/hydrogen-instructions.h
diff --git a/src/hydrogen-instructions.h b/src/hydrogen-instructions.h
index
467e67fb8181d35198ae60ccc3ccb7f2598e3fc7..741a79715203afb000aef9b2f83af5c3b19a31d0
100644
--- a/src/hydrogen-instructions.h
+++ b/src/hydrogen-instructions.h
@@ -5404,7 +5404,7 @@ class HLoadKeyed
IsFastDoubleElementsKind(elements_kind));
if (IsFastSmiOrObjectElementsKind(elements_kind)) {
- if (IsFastSmiElementsKind(elements_kind)) {
+ if (elements_kind == FAST_SMI_ELEMENTS) {
set_type(HType::Smi());
}
Index: src/version.cc
diff --git a/src/version.cc b/src/version.cc
index
245b8aaff8fd65ef78f5066cd15cdc347f5eb8ea..bfa2e18e3283595ed419156492ccf76b38254a34
100644
--- a/src/version.cc
+++ b/src/version.cc
@@ -35,7 +35,7 @@
#define MAJOR_VERSION 3
#define MINOR_VERSION 19
#define BUILD_NUMBER 0
-#define PATCH_LEVEL 1
+#define PATCH_LEVEL 2
// Use 1 for candidates and 0 otherwise.
// (Boolean macro values are not supported by all preprocessors.)
#define IS_CANDIDATE_VERSION 0
Index: test/mjsunit/regress/regress-crbug-233737.js
diff --git a/test/mjsunit/regress/regress-2671.js
b/test/mjsunit/regress/regress-crbug-233737.js
similarity index 86%
copy from test/mjsunit/regress/regress-2671.js
copy to test/mjsunit/regress/regress-crbug-233737.js
index
8da1b8f07f69c487fe9913e485c60f3e257e0986..835726b22429ec3cca68df956255d47c53fcfd25
100644
--- a/test/mjsunit/regress/regress-2671.js
+++ b/test/mjsunit/regress/regress-crbug-233737.js
@@ -27,19 +27,16 @@
// Flags: --allow-natives-syntax
-var y;
-function f() {
- var a = [];
- a[20] = 0;
- y = 3;
- var i = 7 * (y + -0);
- a[i] = 1/y;
- assertFalse(isNaN(a[i]));
-}
+var a = new Array(2);
+a[0] = 1;
+assertTrue(%HasFastSmiElements(a));
+assertTrue(%HasFastHoleyElements(a));
-f();
-f();
-f();
-%OptimizeFunctionOnNextCall(f);
-f();
+function hole(i) {
+ return a[i] << 0;
+}
+assertEquals(1, hole(0));
+assertEquals(1, hole(0));
+%OptimizeFunctionOnNextCall(hole);
+assertEquals(0, hole(1));
\ No newline at end of file
--
--
v8-dev mailing list
[email protected]
http://groups.google.com/group/v8-dev
---
You received this message because you are subscribed to the Google Groups "v8-dev" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
For more options, visit https://groups.google.com/groups/opt_out.
