Reviewers: Benedikt Meurer,
Message:
PTAL
Description:
Bugfix in inlined versions of Array.indexOf() and Array.lastIndexOf() with a
regression test.
BUG=chromium:381534
LOG=N
Please review this at https://codereview.chromium.org/319343002/
SVN Base: https://v8.googlecode.com/svn/branches/bleeding_edge
Affected files (+72, -22 lines):
M src/hydrogen.cc
M src/hydrogen-instructions.cc
A test/mjsunit/regress/regress-crbug-381534.js
Index: src/hydrogen-instructions.cc
diff --git a/src/hydrogen-instructions.cc b/src/hydrogen-instructions.cc
index
96cd016e08b917bd29c68e5f80117c43e3f2d06e..8b40a249d34372d793adad1c69c6496d82e5bd52
100644
--- a/src/hydrogen-instructions.cc
+++ b/src/hydrogen-instructions.cc
@@ -1540,7 +1540,10 @@ HInstruction* HForceRepresentation::New(Zone* zone,
HValue* context,
HConstant* c = HConstant::cast(value);
if (c->HasNumberValue()) {
double double_res = c->DoubleValue();
- if (representation.CanContainDouble(double_res)) {
+ if (representation.IsDouble()) {
+ return HConstant::New(zone, context, double_res);
+
+ } else if (representation.CanContainDouble(double_res)) {
return HConstant::New(zone, context,
static_cast<int32_t>(double_res),
representation);
Index: src/hydrogen.cc
diff --git a/src/hydrogen.cc b/src/hydrogen.cc
index
1e623afc81fa7eba25ecef8081b850efd70f672f..1e061f4677015ea76daa87a578b1fb91c38549fb
100644
--- a/src/hydrogen.cc
+++ b/src/hydrogen.cc
@@ -8522,40 +8522,47 @@ HValue*
HOptimizedGraphBuilder::BuildArrayIndexOf(HValue* receiver,
}
if_isstring.Else();
{
- IfBuilder if_isheapnumber(this);
- if_isheapnumber.IfNot<HIsSmiAndBranch>(search_element);
- HCompareMap* isheapnumber = if_isheapnumber.AndIf<HCompareMap>(
+ IfBuilder if_isnumber(this);
+ if_isnumber.If<HIsSmiAndBranch>(search_element);
+ if_isnumber.OrIf<HCompareMap>(
search_element, isolate()->factory()->heap_number_map());
- if_isheapnumber.Then();
+ if_isnumber.Then();
{
- HValue* search_number = Add<HLoadNamedField>(
- search_element, isheapnumber,
- HObjectAccess::ForHeapNumberValue());
+ HValue* search_number =
+ AddUncasted<HForceRepresentation>(search_element,
+ Representation::Double());
LoopBuilder loop(this, context(), direction);
{
HValue* index = loop.BeginBody(initial, terminating, token);
HValue* element = AddUncasted<HLoadKeyed>(
elements, index, static_cast<HValue*>(NULL),
kind, ALLOW_RETURN_HOLE);
- IfBuilder if_issame(this);
- HCompareMap* issame = if_issame.If<HCompareMap>(
+
+ IfBuilder if_element_isnumber(this);
+ if_element_isnumber.If<HIsSmiAndBranch>(element);
+ if_element_isnumber.OrIf<HCompareMap>(
element, isolate()->factory()->heap_number_map());
- if_issame.And();
- HValue* number = Add<HLoadNamedField>(
- element, issame, HObjectAccess::ForHeapNumberValue());
- if_issame.If<HCompareNumericAndBranch>(
- number, search_number, Token::EQ_STRICT);
- if_issame.Then();
+ if_element_isnumber.Then();
{
- Drop(1);
- Push(index);
- loop.Break();
+ HValue* number =
+ AddUncasted<HForceRepresentation>(element,
+
Representation::Double());
+ IfBuilder if_issame(this);
+ if_issame.If<HCompareNumericAndBranch>(
+ number, search_number, Token::EQ_STRICT);
+ if_issame.Then();
+ {
+ Drop(1);
+ Push(index);
+ loop.Break();
+ }
+ if_issame.End();
}
- if_issame.End();
+ if_element_isnumber.End();
}
loop.EndBody();
}
- if_isheapnumber.Else();
+ if_isnumber.Else();
{
LoopBuilder loop(this, context(), direction);
{
@@ -8576,7 +8583,7 @@ HValue*
HOptimizedGraphBuilder::BuildArrayIndexOf(HValue* receiver,
}
loop.EndBody();
}
- if_isheapnumber.End();
+ if_isnumber.End();
}
if_isstring.End();
}
Index: test/mjsunit/regress/regress-crbug-381534.js
diff --git a/test/mjsunit/regress/regress-crbug-381534.js
b/test/mjsunit/regress/regress-crbug-381534.js
new file mode 100644
index
0000000000000000000000000000000000000000..2aa3929677413bda539d1648c038b75c54a60e41
--- /dev/null
+++ b/test/mjsunit/regress/regress-crbug-381534.js
@@ -0,0 +1,40 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+var obj = {};
+
+function f(v) {
+ var v1 = -(4/3);
+ var v2 = 1;
+ var arr = new Array(+0, true, 0, -0, false, undefined, null, "0", obj,
v1, -(4/3), -1.3333333333333, "str", v2, 1, false);
+ assertEquals(10, arr.lastIndexOf(-(4/3)));
+ assertEquals(9, arr.indexOf(-(4/3)));
+
+ assertEquals(10, arr.lastIndexOf(v));
+ assertEquals(9, arr.indexOf(v));
+
+ assertEquals(8, arr.lastIndexOf(obj));
+ assertEquals(8, arr.indexOf(obj));
+}
+
+function g(v, x, index) {
+ var arr = new Array({}, x-1.1, x-2, x-3.1);
+ assertEquals(index, arr.indexOf(0));
+ assertEquals(index, arr.lastIndexOf(0));
+
+ assertEquals(index, arr.indexOf(v));
+ assertEquals(index, arr.lastIndexOf(v));
+}
+
+f(-(4/3));
+f(-(4/3));
+%OptimizeFunctionOnNextCall(f);
+f(-(4/3));
+
+g(0, 2, 2);
+g(0, 3.1, 3);
+%OptimizeFunctionOnNextCall(g);
+g(0, 1.1, 1);
--
--
v8-dev mailing list
[email protected]
http://groups.google.com/group/v8-dev
---
You received this message because you are subscribed to the Google Groups "v8-dev" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
For more options, visit https://groups.google.com/d/optout.
