Reviewers: dcarney,
Description:
Version 3.25.28.11 (merged r20501)
Make sure value is a heap number when reusing the double box in
BinaryOpICStub.
[email protected]
BUG=359525
Please review this at https://codereview.chromium.org/230863002/
SVN Base: https://v8.googlecode.com/svn/branches/3.25
Affected files (+16, -19 lines):
M src/code-stubs-hydrogen.cc
M src/version.cc
A + test/mjsunit/regress/regress-359525.js
Index: src/code-stubs-hydrogen.cc
diff --git a/src/code-stubs-hydrogen.cc b/src/code-stubs-hydrogen.cc
index
040c2601335f0117df812fef6d527783b20b2586..fd49faa08119aa660a6c2b05e7613820d13df383
100644
--- a/src/code-stubs-hydrogen.cc
+++ b/src/code-stubs-hydrogen.cc
@@ -963,7 +963,7 @@ HValue*
CodeStubGraphBuilder<BinaryOpICStub>::BuildCodeInitializedStub() {
if (state.CanReuseDoubleBox()) {
HValue* operand = (state.mode() == OVERWRITE_LEFT) ? left : right;
IfBuilder if_heap_number(this);
- if_heap_number.IfNot<HIsSmiAndBranch>(operand);
+ if_heap_number.If<HHasInstanceTypeAndBranch>(operand,
HEAP_NUMBER_TYPE);
if_heap_number.Then();
Add<HStoreNamedField>(operand, HObjectAccess::ForHeapNumberValue(),
result);
Push(operand);
Index: src/version.cc
diff --git a/src/version.cc b/src/version.cc
index
7e47248ac8e7661c92ce8f60e46938e661630c8c..224ee1afbb71816de5c31451c007fe44e31983c0
100644
--- a/src/version.cc
+++ b/src/version.cc
@@ -35,7 +35,7 @@
#define MAJOR_VERSION 3
#define MINOR_VERSION 25
#define BUILD_NUMBER 28
-#define PATCH_LEVEL 10
+#define PATCH_LEVEL 11
// Use 1 for candidates and 0 otherwise.
// (Boolean macro values are not supported by all preprocessors.)
#define IS_CANDIDATE_VERSION 0
Index: test/mjsunit/regress/regress-359525.js
diff --git a/test/mjsunit/regress/comparison-in-effect-context-deopt.js
b/test/mjsunit/regress/regress-359525.js
similarity index 84%
copy from test/mjsunit/regress/comparison-in-effect-context-deopt.js
copy to test/mjsunit/regress/regress-359525.js
index
b28dff73a745dfc7445a6c093380c56f51b3fb76..6a82a38fd3d2d7b95e49115f1e35fbf803fff8cc
100644
--- a/test/mjsunit/regress/comparison-in-effect-context-deopt.js
+++ b/test/mjsunit/regress/regress-359525.js
@@ -25,23 +25,20 @@
// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
-// Flags: --allow-natives-syntax
-
-function lazyDeopt() {
- %DeoptimizeFunction(test);
- return "deopt";
+// Test BinaryOpICStub substract
+var a;
+for (var i = 0; i < 2; i++) {
+ var x = 42 + a - {};
+ print(x);
+ a = "";
}
-var x = { toString : lazyDeopt };
-
-function g(x) {
- return "result";
+// Test BinaryOpICStub add
+var b = 1.4;
+var val = 0;
+var o = {valueOf:function() { val++; return 10; }};
+for (var i = 0; i < 2; i++) {
+ var x = (b + i) + o;
+ b = "";
}
-
-function test(x) {
- return g(void(x == ""));
-}
-
-test(x);
-%OptimizeFunctionOnNextCall(test);
-assertEquals("result", test(x));
+assertEquals(val, 2);
--
--
v8-dev mailing list
[email protected]
http://groups.google.com/group/v8-dev
---
You received this message because you are subscribed to the Google Groups "v8-dev" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
For more options, visit https://groups.google.com/d/optout.
