AuroraMiddleware/v8
1
0
Fork 0
Code Issues 2 Pull Requests Releases Wiki Activity

[ic] Properly deal with all oddballs when updating BinaryOpIC state.

Browse Source 
R=jarin@chromium.org
BUG=chromium:659967

Review-Url: https://codereview.chromium.org/2453633005
Cr-Commit-Position: refs/heads/master@{#40616}
This commit is contained in:
bmeurer 2016-10-27 05:16:01 -07:00 committed by Commit bot
parent f80f450993
commit 305948fa76
2 changed files with 10 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
src/ic/ic-state.cc
View File

@ -256,10 +256,10 @@ void BinaryOpICState::Update(Handle<Object> left, Handle<Object> right,
if (old_extra_ic_state == GetExtraICState()) {
// Tagged operations can lead to non-truncating HChanges
if (left->IsUndefined(isolate_) || left->IsBoolean()) {
if (left->IsOddball()) {
left_kind_ = GENERIC;
} else {
DCHECK(right->IsUndefined(isolate_) || right->IsBoolean());
DCHECK(right->IsOddball());
right_kind_ = GENERIC;
}
}

8
test/mjsunit/regress/regress-crbug-659967.js Normal file
View File

@ -0,0 +1,8 @@
// Copyright 2016 the V8 project authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
function f() { null >> arguments; }
f();
f();