Reviewers: Yang, Weiliang,
Message:
Hi guys, PTAL,
--Michael
Description:
Bugfix: HCheckInstanceType::GetCheckMaskAndTag used an incorrect mask.
The mask to check for an internalized string was incorrectly formed. Hat
tip to Weiliang Lin for discovering the bug.
Please review this at https://codereview.chromium.org/108033002/
SVN Base: https://v8.googlecode.com/svn/branches/bleeding_edge
Affected files (+11, -10 lines):
M src/hydrogen-instructions.cc
A + test/mjsunit/regress/internalized-string-not-equal.js
Index: src/hydrogen-instructions.cc
diff --git a/src/hydrogen-instructions.cc b/src/hydrogen-instructions.cc
index
3ab9576515e4efbf81e723fb0ab3dd4fdc047c8e..1ed8df7c15553d64d0979b1d5845ad8efee88eee
100644
--- a/src/hydrogen-instructions.cc
+++ b/src/hydrogen-instructions.cc
@@ -1533,7 +1533,7 @@ void HCheckInstanceType::GetCheckMaskAndTag(uint8_t*
mask, uint8_t* tag) {
*tag = kStringTag;
return;
case IS_INTERNALIZED_STRING:
- *mask = kIsNotInternalizedMask;
+ *mask = kIsNotStringMask | kIsNotInternalizedMask;
*tag = kInternalizedTag;
return;
default:
Index: test/mjsunit/regress/internalized-string-not-equal.js
diff --git a/test/mjsunit/elide-double-hole-check-4.js
b/test/mjsunit/regress/internalized-string-not-equal.js
similarity index 86%
copy from test/mjsunit/elide-double-hole-check-4.js
copy to test/mjsunit/regress/internalized-string-not-equal.js
index
e2a55055710d6aa222ca4c4aecfbe3926d9c5cca..911279b43e6b1174449132bea96fe48144657461
100644
--- a/test/mjsunit/elide-double-hole-check-4.js
+++ b/test/mjsunit/regress/internalized-string-not-equal.js
@@ -27,13 +27,14 @@
// Flags: --allow-natives-syntax
-function f1(a, i) {
- return a[i] + 0.5;
+// A bug in r15773, when masks for internalized string and string types
+// were reorganized.
+function equal(o1, o2) {
+ return (o1 == o2);
}
-var arr = [0.0,,2.5];
-assertEquals(0.5, f1(arr, 0));
-assertEquals(0.5, f1(arr, 0));
-%OptimizeFunctionOnNextCall(f1);
-assertEquals(0.5, f1(arr, 0));
-Array.prototype[1] = 1.5;
-assertEquals(2, f1(arr, 1));
+var a = "abc";
+var b = "abc";
+equal(a, b);
+equal(a, b);
+%OptimizeFunctionOnNextCall(equal);
+assertTrue(equal(1.3, 1.3));
--
--
v8-dev mailing list
[email protected]
http://groups.google.com/group/v8-dev
---
You received this message because you are subscribed to the Google Groups "v8-dev" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
For more options, visit https://groups.google.com/groups/opt_out.
