AuroraMiddleware/v8
1
0
Fork 0
Code Issues 2 Pull Requests Releases Wiki Activity

Iterate through all arguments for side effects in Math.min/max.

Browse Source 
R=svenpanne@chromium.org
BUG=v8:2444

Review URL: https://chromiumcodereview.appspot.com/11444030

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13150 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
This commit is contained in:
yangguo@chromium.org 2012-12-06 13:13:38 +00:00
parent 2200972f48
commit 276c790c61
2 changed files with 132 additions and 18 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

30
src/math.js
View File

@ -131,19 +131,16 @@ function MathMax(arg1, arg2) { // length == 2
// All comparisons failed, one of the arguments must be NaN.
return 0/0; // Compiler constant-folds this to NaN.
}
if (length == 0) {
return -1/0; // Compiler constant-folds this to -Infinity.
}
var r = arg1;
if (!IS_NUMBER(r)) r = NonNumberToNumber(r);
if (NUMBER_IS_NAN(r)) return r;
for (var i = 1; i < length; i++) {
var r = -1/0; // Compiler constant-folds this to -Infinity.
for (var i = 0; i < length; i++) {
var n = %_Arguments(i);
if (!IS_NUMBER(n)) n = NonNumberToNumber(n);
if (NUMBER_IS_NAN(n)) return n;
// Make sure +0 is considered greater than -0. -0 is never a Smi, +0 can be
// a Smi or heap number.
if (n > r || (r == 0 && n == 0 && !%_IsSmi(r) && 1 / r < 0)) r = n;
if (NUMBER_IS_NAN(n) || n > r ||
(r == 0 && n == 0 && !%_IsSmi(r) && 1 / r < 0)) {
r = n;
}
}
return r;
}
@ -164,19 +161,16 @@ function MathMin(arg1, arg2) { // length == 2
// All comparisons failed, one of the arguments must be NaN.
return 0/0; // Compiler constant-folds this to NaN.
}
if (length == 0) {
return 1/0; // Compiler constant-folds this to Infinity.
}
var r = arg1;
if (!IS_NUMBER(r)) r = NonNumberToNumber(r);
if (NUMBER_IS_NAN(r)) return r;
for (var i = 1; i < length; i++) {
var r = 1/0; // Compiler constant-folds this to Infinity.
for (var i = 0; i < length; i++) {
var n = %_Arguments(i);
if (!IS_NUMBER(n)) n = NonNumberToNumber(n);
if (NUMBER_IS_NAN(n)) return n;
// Make sure -0 is considered less than +0. -0 is never a Smi, +0 can be a
// Smi or a heap number.
if (n < r || (r == 0 && n == 0 && !%_IsSmi(n) && 1 / n < 0)) r = n;
if (NUMBER_IS_NAN(n) || n < r ||
(r == 0 && n == 0 && !%_IsSmi(n) && 1 / n < 0)) {
r = n;
}
}
return r;
}

120
test/mjsunit/regress/regress-2444.js Normal file
View File

@ -0,0 +1,120 @@
// Copyright 2012 the V8 project authors. All rights reserved.
// Redistribution and use in source and binary forms, with or without
// modification, are permitted provided that the following conditions are
// met:
//
// * Redistributions of source code must retain the above copyright
// notice, this list of conditions and the following disclaimer.
// * Redistributions in binary form must reproduce the above
// copyright notice, this list of conditions and the following
// disclaimer in the documentation and/or other materials provided
// with the distribution.
// * Neither the name of Google Inc. nor the names of its
// contributors may be used to endorse or promote products derived
// from this software without specific prior written permission.
//
// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
var flags;
function resetFlags(size) {
flags = Array(size);
while (size--) flags[size] = 0;
}
function assertFlags(array) {
assertArrayEquals(array, flags);
}
function object_factory(flag_index, value, expected_flags) {
var obj = {};
obj.valueOf = function() {
assertFlags(expected_flags);
flags[flag_index]++;
return value;
}
return obj;
}
assertEquals(-Infinity, Math.max());
resetFlags(1);
assertEquals(NaN,
Math.max(object_factory(0, NaN, [0])));
assertFlags([1]);
resetFlags(2);
assertEquals(NaN,
Math.max(object_factory(0, NaN, [0, 0]),
object_factory(1, 0, [1, 0])));
assertFlags([1, 1]);
resetFlags(3);
assertEquals(NaN,
Math.max(object_factory(0, NaN, [0, 0, 0]),
object_factory(1, 0, [1, 0, 0]),
object_factory(2, 1, [1, 1, 0])));
assertFlags([1, 1, 1]);
resetFlags(3);
assertEquals(NaN,
Math.max(object_factory(0, 2, [0, 0, 0]),
object_factory(1, 0, [1, 0, 0]),
object_factory(2, NaN, [1, 1, 0])));
assertFlags([1, 1, 1]);
resetFlags(3);
assertEquals(2,
Math.max(object_factory(0, 2, [0, 0, 0]),
object_factory(1, 0, [1, 0, 0]),
object_factory(2, 1, [1, 1, 0])));
assertFlags([1, 1, 1]);
assertEquals(+Infinity, Math.min());
resetFlags(1);
assertEquals(NaN,
Math.min(object_factory(0, NaN, [0])));
assertFlags([1]);
resetFlags(2);
assertEquals(NaN,
Math.min(object_factory(0, NaN, [0, 0]),
object_factory(1, 0, [1, 0])));
assertFlags([1, 1]);
resetFlags(3);
assertEquals(NaN,
Math.min(object_factory(0, NaN, [0, 0, 0]),
object_factory(1, 0, [1, 0, 0]),
object_factory(2, 1, [1, 1, 0])));
assertFlags([1, 1, 1]);
resetFlags(3);
assertEquals(NaN,
Math.min(object_factory(0, 2, [0, 0, 0]),
object_factory(1, 0, [1, 0, 0]),
object_factory(2, NaN, [1, 1, 0])));
assertFlags([1, 1, 1]);
resetFlags(3);
assertEquals(0,
Math.min(object_factory(0, 2, [0, 0, 0]),
object_factory(1, 0, [1, 0, 0]),
object_factory(2, 1, [1, 1, 0])));
assertFlags([1, 1, 1]);