AuroraMiddleware/v8
1
0
Fork 0
Code Issues 2 Pull Requests Releases Wiki Activity

[ic] Unify undetectable abstract equality comparison.

Browse Source 
The treatment of different undetectable objects was inconsistent after
the latest changes to the undetectable bit in the maps. Given two
different undetectable JSObjects a and b, a monomorphic CompareIC would
say false for a == b, while the rest of the system (including the
generic case for the CompareIC) would say true.

The fix is rather straight-forward: We just go generic on a CompareIC
once we see an undetectable JSObject.

R=yangguo@chromium.org

Review URL: https://codereview.chromium.org/1735863004

Cr-Commit-Position: refs/heads/master@{#34315}
This commit is contained in:
bmeurer 2016-02-25 22:16:42 -08:00 committed by Commit bot
parent 829f951aae
commit 1b821f2f39
3 changed files with 20 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

11
src/ic/ic-state.cc
View File

@ -404,7 +404,9 @@ CompareICState::State CompareICState::NewInputState(State old_state,
if (value->IsInternalizedString()) return INTERNALIZED_STRING;
if (value->IsString()) return STRING;
if (value->IsSymbol()) return UNIQUE_NAME;
if (value->IsJSReceiver()) return RECEIVER;
if (value->IsJSReceiver() && !value->IsUndetectableObject()) {
return RECEIVER;
}
break;
case BOOLEAN:
if (value->IsBoolean()) return BOOLEAN;
@ -428,7 +430,9 @@ CompareICState::State CompareICState::NewInputState(State old_state,
if (value->IsUniqueName()) return UNIQUE_NAME;
break;
case RECEIVER:
if (value->IsJSReceiver()) return RECEIVER;
if (value->IsJSReceiver() && !value->IsUndetectableObject()) {
return RECEIVER;
}
break;
case GENERIC:
break;
@ -464,6 +468,9 @@ CompareICState::State CompareICState::TargetState(
}
if (x->IsString() && y->IsString()) return STRING;
if (x->IsJSReceiver() && y->IsJSReceiver()) {
if (x->IsUndetectableObject() || y->IsUndetectableObject()) {
return GENERIC;
}
if (Handle<JSReceiver>::cast(x)->map() ==
Handle<JSReceiver>::cast(y)->map()) {
return KNOWN_RECEIVER;

1
test/mjsunit/mjsunit.status
View File

@ -866,7 +866,6 @@
# TODO(rmcilroy,4680): Test assert failures.
'array-literal-feedback': [FAIL],
'undetectable-compare': [FAIL],
'debug-liveedit-2': [FAIL],
'compiler/deopt-tonumber-compare': [FAIL],
'es6/string-search': [FAIL],

12
test/mjsunit/undetectable-compare.js
View File

@ -92,5 +92,15 @@ for (var i = 0; i < 5; i++) {
}
assertFalse(undetectable == %GetUndetectable());
assertTrue(undetectable == %GetUndetectable());
assertFalse(undetectable === %GetUndetectable());
function test2(a, b) {
assertTrue(a == b);
}
test2(1, 1);
test2(undetectable, undetectable);
for (var i = 0; i < 5; ++i) {
test2(undetectable, %GetUndetectable());
}