Reviewers: danno,
Description:
Merged r14638 into 3.17 branch.
Fix missing hole check for loads from Smi arrays when all uses are changes
BUG=chromium:233737
[email protected]
Please review this at https://codereview.chromium.org/14698021/
SVN Base: https://v8.googlecode.com/svn/branches/3.17
Affected files:
M src/hydrogen-instructions.h
M src/version.cc
A + test/mjsunit/regress/regress-crbug-233737.js
Index: src/hydrogen-instructions.h
diff --git a/src/hydrogen-instructions.h b/src/hydrogen-instructions.h
index
ea546212735a1c808d448b4c24e389bc42af8a97..205bace69f8fdbbf9e7d273c885f232f547af9ef
100644
--- a/src/hydrogen-instructions.h
+++ b/src/hydrogen-instructions.h
@@ -5035,7 +5035,7 @@ class HLoadKeyed
IsFastDoubleElementsKind(elements_kind));
if (IsFastSmiOrObjectElementsKind(elements_kind)) {
- if (IsFastSmiElementsKind(elements_kind)) {
+ if (elements_kind == FAST_SMI_ELEMENTS) {
set_type(HType::Smi());
}
Index: src/version.cc
diff --git a/src/version.cc b/src/version.cc
index
d51aa8829e4e9196ab60a7cba15b29f03c1a8b43..c253723bd2817415d3b14d5424b455661f6da92b
100644
--- a/src/version.cc
+++ b/src/version.cc
@@ -35,7 +35,7 @@
#define MAJOR_VERSION 3
#define MINOR_VERSION 17
#define BUILD_NUMBER 6
-#define PATCH_LEVEL 13
+#define PATCH_LEVEL 14
// Use 1 for candidates and 0 otherwise.
// (Boolean macro values are not supported by all preprocessors.)
#define IS_CANDIDATE_VERSION 0
Index: test/mjsunit/regress/regress-crbug-233737.js
diff --git a/test/mjsunit/regress/regress-2451.js
b/test/mjsunit/regress/regress-crbug-233737.js
similarity index 86%
copy from test/mjsunit/regress/regress-2451.js
copy to test/mjsunit/regress/regress-crbug-233737.js
index
465e4e68c26f3e3e119cbaf82d50c8f83c6efa9a..835726b22429ec3cca68df956255d47c53fcfd25
100644
--- a/test/mjsunit/regress/regress-2451.js
+++ b/test/mjsunit/regress/regress-crbug-233737.js
@@ -27,15 +27,16 @@
// Flags: --allow-natives-syntax
-function f() {
- assertEquals(-1.0, Math.round(-1.5));
- assertEquals(-2.0, Math.round(-2.5));
- assertEquals(-1.0, Math.round(-0.5000000000000001));
-}
+var a = new Array(2);
+a[0] = 1;
+assertTrue(%HasFastSmiElements(a));
+assertTrue(%HasFastHoleyElements(a));
-f();
-f();
-%OptimizeFunctionOnNextCall(f);
-f();
-assertTrue(%GetOptimizationStatus(f) != 2);
+function hole(i) {
+ return a[i] << 0;
+}
+assertEquals(1, hole(0));
+assertEquals(1, hole(0));
+%OptimizeFunctionOnNextCall(hole);
+assertEquals(0, hole(1));
\ No newline at end of file
--
--
v8-dev mailing list
[email protected]
http://groups.google.com/group/v8-dev
---
You received this message because you are subscribed to the Google Groups "v8-dev" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
For more options, visit https://groups.google.com/groups/opt_out.
