Reviewers: dcarney,
Description:
Version 3.24.35.32 (merged r20501)
Make sure value is a heap number when reusing the double box in
BinaryOpICStub.
[email protected]
BUG=359525
Please review this at https://codereview.chromium.org/230623003/
SVN Base: https://v8.googlecode.com/svn/branches/3.24
Affected files (+17, -17 lines):
M src/code-stubs-hydrogen.cc
M src/version.cc
A + test/mjsunit/regress/regress-359525.js
Index: src/code-stubs-hydrogen.cc
diff --git a/src/code-stubs-hydrogen.cc b/src/code-stubs-hydrogen.cc
index
455d08768491863feb2f9446b74abe7422a4abf3..a7c1847ecbd1314125f798f0db1287a3f801c7df
100644
--- a/src/code-stubs-hydrogen.cc
+++ b/src/code-stubs-hydrogen.cc
@@ -936,7 +936,7 @@ HValue*
CodeStubGraphBuilder<BinaryOpICStub>::BuildCodeInitializedStub() {
if (state.CanReuseDoubleBox()) {
HValue* operand = (state.mode() == OVERWRITE_LEFT) ? left : right;
IfBuilder if_heap_number(this);
- if_heap_number.IfNot<HIsSmiAndBranch>(operand);
+ if_heap_number.If<HHasInstanceTypeAndBranch>(operand,
HEAP_NUMBER_TYPE);
if_heap_number.Then();
Add<HStoreNamedField>(operand, HObjectAccess::ForHeapNumberValue(),
result);
Push(operand);
Index: src/version.cc
diff --git a/src/version.cc b/src/version.cc
index
75dec483d479e7c45551c9fca95a7579159a64bf..bb2cf2816255b23d5d82545ff655990d54320523
100644
--- a/src/version.cc
+++ b/src/version.cc
@@ -35,7 +35,7 @@
#define MAJOR_VERSION 3
#define MINOR_VERSION 24
#define BUILD_NUMBER 35
-#define PATCH_LEVEL 31
+#define PATCH_LEVEL 32
// Use 1 for candidates and 0 otherwise.
// (Boolean macro values are not supported by all preprocessors.)
#define IS_CANDIDATE_VERSION 0
Index: test/mjsunit/regress/regress-359525.js
diff --git a/test/mjsunit/regress/regress-331444.js
b/test/mjsunit/regress/regress-359525.js
similarity index 84%
copy from test/mjsunit/regress/regress-331444.js
copy to test/mjsunit/regress/regress-359525.js
index
c78d6fb71b7c455abfcd1450d80b5c8a6dcb6e38..6a82a38fd3d2d7b95e49115f1e35fbf803fff8cc
100644
--- a/test/mjsunit/regress/regress-331444.js
+++ b/test/mjsunit/regress/regress-359525.js
@@ -25,20 +25,20 @@
// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
-// Flags: --expose-gc
-
-function boom() {
- var args = [];
- for (var i = 0; i < 125000; i++)
- args.push(i);
- return Array.apply(Array, args);
+// Test BinaryOpICStub substract
+var a;
+for (var i = 0; i < 2; i++) {
+ var x = 42 + a - {};
+ print(x);
+ a = "";
}
-var array = boom();
-function fib(n) {
- var f0 = 0, f1 = 1;
- for (; n > 0; n = n - 1) {
- f0 + f1;
- f0 = array;
- }
+
+// Test BinaryOpICStub add
+var b = 1.4;
+var val = 0;
+var o = {valueOf:function() { val++; return 10; }};
+for (var i = 0; i < 2; i++) {
+ var x = (b + i) + o;
+ b = "";
}
-fib(12);
+assertEquals(val, 2);
--
--
v8-dev mailing list
[email protected]
http://groups.google.com/group/v8-dev
---
You received this message because you are subscribed to the Google Groups "v8-dev" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
For more options, visit https://groups.google.com/d/optout.
