Reviewers: titzer,
Description:
Merged r19545, r19668, r19670 into 3.24 branch.
Mark HCompareMap as having Tagged representation
x64: Fix LMathMinMax for constant Smi right-hand operands
Handle exception when retrieving toJSON function in JSON.stringify.
BUG=chromium:346636,chromium:349079,349335
LOG=N
[email protected]
Please review this at https://codereview.chromium.org/183023008/
SVN Base: https://v8.googlecode.com/svn/branches/3.24
Affected files (+67, -6 lines):
M src/hydrogen-instructions.h
M src/json-stringifier.h
M src/version.cc
M src/x64/lithium-x64.cc
M test/mjsunit/json2.js
A test/mjsunit/regress/regress-crbug-346636.js
A test/mjsunit/regress/regress-crbug-349079.js
Index: src/hydrogen-instructions.h
diff --git a/src/hydrogen-instructions.h b/src/hydrogen-instructions.h
index
265f06523462eb73c93245fca2867d79a074dd0a..41dbb4e0b0ce41607b6a945492c47ea1ce07686d
100644
--- a/src/hydrogen-instructions.h
+++ b/src/hydrogen-instructions.h
@@ -1566,6 +1566,7 @@ class HCompareMap V8_FINAL : public
HUnaryControlInstruction {
: HUnaryControlInstruction(value, true_target, false_target),
known_successor_index_(kNoKnownSuccessorIndex),
map_(Unique<Map>(map)) {
ASSERT(!map.is_null());
+ set_representation(Representation::Tagged());
}
int known_successor_index_;
Index: src/json-stringifier.h
diff --git a/src/json-stringifier.h b/src/json-stringifier.h
index
0d17b356abb0a1ac1a8447954db81f1386483083..4510c4b45b65b9b8c18079a46e901d69eb4a355f
100644
--- a/src/json-stringifier.h
+++ b/src/json-stringifier.h
@@ -360,6 +360,7 @@ Handle<Object>
BasicJsonStringifier::ApplyToJsonFunction(
PropertyAttributes attr;
Handle<Object> fun =
Object::GetProperty(object, object, &lookup, tojson_string_, &attr);
+ if (fun.is_null()) return Handle<Object>::null();
if (!fun->IsJSFunction()) return object;
// Call toJSON function.
Index: src/version.cc
diff --git a/src/version.cc b/src/version.cc
index
c63d489334a0bb520c9b6389e7efeb16012b2769..ed4d22633cd1bff3b24e99134d6b5b4adc1fef51
100644
--- a/src/version.cc
+++ b/src/version.cc
@@ -35,7 +35,7 @@
#define MAJOR_VERSION 3
#define MINOR_VERSION 24
#define BUILD_NUMBER 35
-#define PATCH_LEVEL 12
+#define PATCH_LEVEL 13
// Use 1 for candidates and 0 otherwise.
// (Boolean macro values are not supported by all preprocessors.)
#define IS_CANDIDATE_VERSION 0
Index: src/x64/lithium-x64.cc
diff --git a/src/x64/lithium-x64.cc b/src/x64/lithium-x64.cc
index
666b688c92abf61b066343076bd0466b39be47e7..88f76658f32d2da6214c372a2a2cc17c1b81c98f
100644
--- a/src/x64/lithium-x64.cc
+++ b/src/x64/lithium-x64.cc
@@ -1427,15 +1427,16 @@ LInstruction* LChunkBuilder::DoAdd(HAdd* instr) {
LInstruction* LChunkBuilder::DoMathMinMax(HMathMinMax* instr) {
LOperand* left = NULL;
LOperand* right = NULL;
- if (instr->representation().IsSmiOrInteger32()) {
-
ASSERT(instr->left()->representation().Equals(instr->representation()));
-
ASSERT(instr->right()->representation().Equals(instr->representation()));
+ ASSERT(instr->left()->representation().Equals(instr->representation()));
+ ASSERT(instr->right()->representation().Equals(instr->representation()));
+ if (instr->representation().IsSmi()) {
+ left = UseRegisterAtStart(instr->BetterLeftOperand());
+ right = UseAtStart(instr->BetterRightOperand());
+ } else if (instr->representation().IsInteger32()) {
left = UseRegisterAtStart(instr->BetterLeftOperand());
right = UseOrConstantAtStart(instr->BetterRightOperand());
} else {
ASSERT(instr->representation().IsDouble());
- ASSERT(instr->left()->representation().IsDouble());
- ASSERT(instr->right()->representation().IsDouble());
left = UseRegisterAtStart(instr->left());
right = UseRegisterAtStart(instr->right());
}
Index: test/mjsunit/json2.js
diff --git a/test/mjsunit/json2.js b/test/mjsunit/json2.js
index
0894d779ac14bf3e885a45584327eab018b64448..f048f05290c9bec50418ee37bb821bf5e8c8d3c4
100644
--- a/test/mjsunit/json2.js
+++ b/test/mjsunit/json2.js
@@ -105,6 +105,10 @@ var tojson_via_getter = { get toJSON() {
a: 1 };
TestStringify('321', tojson_via_getter);
+assertThrows(function() {
+ JSON.stringify({ get toJSON() { throw "error"; } });
+});
+
// Test toJSON with key.
tojson_obj = { toJSON: function(key) { return key + key; } };
var tojson_with_key_1 = { a: tojson_obj, b: tojson_obj };
Index: test/mjsunit/regress/regress-crbug-346636.js
diff --git a/test/mjsunit/regress/regress-crbug-346636.js
b/test/mjsunit/regress/regress-crbug-346636.js
new file mode 100644
index
0000000000000000000000000000000000000000..247f8be48223a1323090d3794c946c9cf2562c55
--- /dev/null
+++ b/test/mjsunit/regress/regress-crbug-346636.js
@@ -0,0 +1,31 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function assertSame(expected, found) {
+ if (found === expected) {
+ if (expected !== 0 || (1 / expected) == (1 / found)) return;
+ }
+ return;
+};
+
+function foo(x) {
+ return x.bar;
+}
+
+function getter1() {
+ assertSame(this, this);
+}
+var o1 = Object.defineProperty({}, "bar", { get: getter1 });
+foo(o1);
+foo(o1);
+
+function getter2() {
+ assertSame(this, this);
+}
+var o2 = Object.defineProperty({}, "bar", { get: getter2 });
+foo(o2);
+%OptimizeFunctionOnNextCall(foo);
+foo(o2);
Index: test/mjsunit/regress/regress-crbug-349079.js
diff --git a/test/mjsunit/regress/regress-crbug-349079.js
b/test/mjsunit/regress/regress-crbug-349079.js
new file mode 100644
index
0000000000000000000000000000000000000000..b1076ea435c7d1e66c7bb906bf718b1ba1dc2a7b
--- /dev/null
+++ b/test/mjsunit/regress/regress-crbug-349079.js
@@ -0,0 +1,23 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function assertEquals(expected, found) {
+ return found === expected;
+};
+%NeverOptimizeFunction(assertEquals);
+
+function crash() {
+ var a = 1;
+ var b = -0;
+ var c = 1.5;
+ assertEquals(b, Math.max(b++, c++));
+ assertEquals(c, Math.min(b++, c++));
+ assertEquals(b, Math.max(b++, a++));
+}
+crash();
+crash();
+%OptimizeFunctionOnNextCall(crash);
+crash();
--
--
v8-dev mailing list
[email protected]
http://groups.google.com/group/v8-dev
---
You received this message because you are subscribed to the Google Groups "v8-dev" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
For more options, visit https://groups.google.com/groups/opt_out.
