Reviewers: danno,

Message:
PTAL

Description:
Fix missing smi check in inlined indexOf/lastIndexOf.

BUG=382513
LOG=y

Please review this at https://codereview.chromium.org/313233005/

SVN Base: https://v8.googlecode.com/svn/branches/bleeding_edge

Affected files (+5, -7 lines):
  M src/hydrogen.cc
  A + test/mjsunit/regress/regress-crbug-382513.js


Index: src/hydrogen.cc
diff --git a/src/hydrogen.cc b/src/hydrogen.cc
index 1e623afc81fa7eba25ecef8081b850efd70f672f..df83f040e49d9d7c237d2093332825c837d20324 100644
--- a/src/hydrogen.cc
+++ b/src/hydrogen.cc
@@ -8538,7 +8538,8 @@ HValue* HOptimizedGraphBuilder::BuildArrayIndexOf(HValue* receiver,
               elements, index, static_cast<HValue*>(NULL),
               kind, ALLOW_RETURN_HOLE);
           IfBuilder if_issame(this);
-          HCompareMap* issame = if_issame.If<HCompareMap>(
+          if_issame.IfNot<HIsSmiAndBranch>(element);
+          HCompareMap* issame = if_issame.AndIf<HCompareMap>(
               element, isolate()->factory()->heap_number_map());
           if_issame.And();
           HValue* number = Add<HLoadNamedField>(
Index: test/mjsunit/regress/regress-crbug-382513.js
diff --git a/test/mjsunit/regress/regress-347906.js b/test/mjsunit/regress/regress-crbug-382513.js
similarity index 70%
copy from test/mjsunit/regress/regress-347906.js
copy to test/mjsunit/regress/regress-crbug-382513.js
index c751618928c93015679087ee1b500637657aa341..be8733c5e411e4b1ce2670a3317463c801b1aaa8 100644
--- a/test/mjsunit/regress/regress-347906.js
+++ b/test/mjsunit/regress/regress-crbug-382513.js
@@ -1,13 +1,10 @@
 // Copyright 2014 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
+//
+// Flags: --allow-native-syntax

-// Flags: --allow-natives-syntax --harmony
-
-function foo() {
-  return Math.clz32(12.34);
-}
-
+function foo() { return [+0,false].indexOf(-(4/3)); }
 foo();
 foo();
 %OptimizeFunctionOnNextCall(foo);


--
--
v8-dev mailing list
[email protected]
http://groups.google.com/group/v8-dev
--- You received this message because you are subscribed to the Google Groups "v8-dev" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to [email protected].
For more options, visit https://groups.google.com/d/optout.

Reply via email to