Revision: 19671
Author: [email protected]
Date: Wed Mar 5 12:21:17 2014 UTC
Log: Merged r19545, r19668, r19670 into 3.24 branch.
Mark HCompareMap as having Tagged representation
x64: Fix LMathMinMax for constant Smi right-hand operands
Handle exception when retrieving toJSON function in JSON.stringify.
BUG=chromium:346636,chromium:349079,349335
LOG=N
[email protected]
Review URL: https://codereview.chromium.org/183023008
http://code.google.com/p/v8/source/detail?r=19671
Added:
/branches/3.24/test/mjsunit/regress/regress-crbug-346636.js
/branches/3.24/test/mjsunit/regress/regress-crbug-349079.js
Modified:
/branches/3.24/src/hydrogen-instructions.h
/branches/3.24/src/json-stringifier.h
/branches/3.24/src/version.cc
/branches/3.24/src/x64/lithium-x64.cc
/branches/3.24/test/mjsunit/json2.js
=======================================
--- /dev/null
+++ /branches/3.24/test/mjsunit/regress/regress-crbug-346636.js Wed Mar 5
12:21:17 2014 UTC
@@ -0,0 +1,31 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function assertSame(expected, found) {
+ if (found === expected) {
+ if (expected !== 0 || (1 / expected) == (1 / found)) return;
+ }
+ return;
+};
+
+function foo(x) {
+ return x.bar;
+}
+
+function getter1() {
+ assertSame(this, this);
+}
+var o1 = Object.defineProperty({}, "bar", { get: getter1 });
+foo(o1);
+foo(o1);
+
+function getter2() {
+ assertSame(this, this);
+}
+var o2 = Object.defineProperty({}, "bar", { get: getter2 });
+foo(o2);
+%OptimizeFunctionOnNextCall(foo);
+foo(o2);
=======================================
--- /dev/null
+++ /branches/3.24/test/mjsunit/regress/regress-crbug-349079.js Wed Mar 5
12:21:17 2014 UTC
@@ -0,0 +1,23 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function assertEquals(expected, found) {
+ return found === expected;
+};
+%NeverOptimizeFunction(assertEquals);
+
+function crash() {
+ var a = 1;
+ var b = -0;
+ var c = 1.5;
+ assertEquals(b, Math.max(b++, c++));
+ assertEquals(c, Math.min(b++, c++));
+ assertEquals(b, Math.max(b++, a++));
+}
+crash();
+crash();
+%OptimizeFunctionOnNextCall(crash);
+crash();
=======================================
--- /branches/3.24/src/hydrogen-instructions.h Fri Feb 7 09:11:16 2014 UTC
+++ /branches/3.24/src/hydrogen-instructions.h Wed Mar 5 12:21:17 2014 UTC
@@ -1566,6 +1566,7 @@
: HUnaryControlInstruction(value, true_target, false_target),
known_successor_index_(kNoKnownSuccessorIndex),
map_(Unique<Map>(map)) {
ASSERT(!map.is_null());
+ set_representation(Representation::Tagged());
}
int known_successor_index_;
=======================================
--- /branches/3.24/src/json-stringifier.h Wed Sep 11 08:25:48 2013 UTC
+++ /branches/3.24/src/json-stringifier.h Wed Mar 5 12:21:17 2014 UTC
@@ -360,6 +360,7 @@
PropertyAttributes attr;
Handle<Object> fun =
Object::GetProperty(object, object, &lookup, tojson_string_, &attr);
+ if (fun.is_null()) return Handle<Object>::null();
if (!fun->IsJSFunction()) return object;
// Call toJSON function.
=======================================
--- /branches/3.24/src/version.cc Tue Mar 4 13:24:52 2014 UTC
+++ /branches/3.24/src/version.cc Wed Mar 5 12:21:17 2014 UTC
@@ -35,7 +35,7 @@
#define MAJOR_VERSION 3
#define MINOR_VERSION 24
#define BUILD_NUMBER 35
-#define PATCH_LEVEL 12
+#define PATCH_LEVEL 13
// Use 1 for candidates and 0 otherwise.
// (Boolean macro values are not supported by all preprocessors.)
#define IS_CANDIDATE_VERSION 0
=======================================
--- /branches/3.24/src/x64/lithium-x64.cc Thu Feb 6 01:06:18 2014 UTC
+++ /branches/3.24/src/x64/lithium-x64.cc Wed Mar 5 12:21:17 2014 UTC
@@ -1427,15 +1427,16 @@
LInstruction* LChunkBuilder::DoMathMinMax(HMathMinMax* instr) {
LOperand* left = NULL;
LOperand* right = NULL;
- if (instr->representation().IsSmiOrInteger32()) {
-
ASSERT(instr->left()->representation().Equals(instr->representation()));
-
ASSERT(instr->right()->representation().Equals(instr->representation()));
+ ASSERT(instr->left()->representation().Equals(instr->representation()));
+ ASSERT(instr->right()->representation().Equals(instr->representation()));
+ if (instr->representation().IsSmi()) {
+ left = UseRegisterAtStart(instr->BetterLeftOperand());
+ right = UseAtStart(instr->BetterRightOperand());
+ } else if (instr->representation().IsInteger32()) {
left = UseRegisterAtStart(instr->BetterLeftOperand());
right = UseOrConstantAtStart(instr->BetterRightOperand());
} else {
ASSERT(instr->representation().IsDouble());
- ASSERT(instr->left()->representation().IsDouble());
- ASSERT(instr->right()->representation().IsDouble());
left = UseRegisterAtStart(instr->left());
right = UseRegisterAtStart(instr->right());
}
=======================================
--- /branches/3.24/test/mjsunit/json2.js Tue Nov 26 13:50:38 2013 UTC
+++ /branches/3.24/test/mjsunit/json2.js Wed Mar 5 12:21:17 2014 UTC
@@ -105,6 +105,10 @@
a: 1 };
TestStringify('321', tojson_via_getter);
+assertThrows(function() {
+ JSON.stringify({ get toJSON() { throw "error"; } });
+});
+
// Test toJSON with key.
tojson_obj = { toJSON: function(key) { return key + key; } };
var tojson_with_key_1 = { a: tojson_obj, b: tojson_obj };
--
--
v8-dev mailing list
[email protected]
http://groups.google.com/group/v8-dev
---
You received this message because you are subscribed to the Google Groups "v8-dev" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
For more options, visit https://groups.google.com/groups/opt_out.
