[builtins] Fix Object.create(null) special case
Fix failing assertions in the CodeStubAssembler that cause Object.create(null, global) fail. Drive-by-fix: convert some Assert to CSA_ASSERT. BUG=chromium:657692 Review-Url: https://codereview.chromium.org/2446203003 Cr-Commit-Position: refs/heads/master@{#40576}
This commit is contained in:
parent
e408864d60
commit
58e0e3f635
@ -1111,11 +1111,14 @@ Node* CodeStubAssembler::LoadMapConstructor(Node* map) {
|
||||
}
|
||||
|
||||
Node* CodeStubAssembler::IsSpecialReceiverMap(Node* map) {
|
||||
Node* is_special = IsSpecialReceiverInstanceType(LoadMapInstanceType(map));
|
||||
Node* bit_field = LoadMapBitField(map);
|
||||
Node* mask = Int32Constant(1 << Map::kHasNamedInterceptor |
|
||||
1 << Map::kIsAccessCheckNeeded);
|
||||
Assert(Word32Equal(Word32And(bit_field, mask), Int32Constant(0)));
|
||||
return IsSpecialReceiverInstanceType(LoadMapInstanceType(map));
|
||||
uint32_t mask =
|
||||
1 << Map::kHasNamedInterceptor | 1 << Map::kIsAccessCheckNeeded;
|
||||
// Interceptors or access checks imply special receiver.
|
||||
CSA_ASSERT(
|
||||
Select(IsSetWord32(bit_field, mask), is_special, Int32Constant(1)));
|
||||
return is_special;
|
||||
}
|
||||
|
||||
Node* CodeStubAssembler::IsSpecialReceiverInstanceType(Node* instance_type) {
|
||||
@ -6941,7 +6944,7 @@ void CodeStubAssembler::BranchIfNumericRelationalComparison(
|
||||
|
||||
Bind(&if_rhsisnotsmi);
|
||||
{
|
||||
Assert(WordEqual(LoadMap(rhs), HeapNumberMapConstant()));
|
||||
CSA_ASSERT(WordEqual(LoadMap(rhs), HeapNumberMapConstant()));
|
||||
// Convert the {lhs} and {rhs} to floating point values, and
|
||||
// perform a floating point comparison.
|
||||
var_fcmp_lhs.Bind(SmiToFloat64(lhs));
|
||||
@ -6952,7 +6955,7 @@ void CodeStubAssembler::BranchIfNumericRelationalComparison(
|
||||
|
||||
Bind(&if_lhsisnotsmi);
|
||||
{
|
||||
Assert(WordEqual(LoadMap(lhs), HeapNumberMapConstant()));
|
||||
CSA_ASSERT(WordEqual(LoadMap(lhs), HeapNumberMapConstant()));
|
||||
|
||||
// Check if {rhs} is a Smi or a HeapObject.
|
||||
Label if_rhsissmi(this), if_rhsisnotsmi(this);
|
||||
@ -6969,7 +6972,7 @@ void CodeStubAssembler::BranchIfNumericRelationalComparison(
|
||||
|
||||
Bind(&if_rhsisnotsmi);
|
||||
{
|
||||
Assert(WordEqual(LoadMap(rhs), HeapNumberMapConstant()));
|
||||
CSA_ASSERT(WordEqual(LoadMap(rhs), HeapNumberMapConstant()));
|
||||
|
||||
// Convert the {lhs} and {rhs} to floating point values, and
|
||||
// perform a floating point comparison.
|
||||
@ -8386,7 +8389,7 @@ compiler::Node* CodeStubAssembler::NumberInc(compiler::Node* value) {
|
||||
Bind(&if_isnotsmi);
|
||||
{
|
||||
// Check if the value is a HeapNumber.
|
||||
Assert(IsHeapNumberMap(LoadMap(value)));
|
||||
CSA_ASSERT(IsHeapNumberMap(LoadMap(value)));
|
||||
|
||||
// Load the HeapNumber value.
|
||||
var_finc_value.Bind(LoadHeapNumberValue(value));
|
||||
@ -8441,7 +8444,7 @@ compiler::Node* CodeStubAssembler::CreateArrayIterator(
|
||||
Context::UINT8_ARRAY_KEY_VALUE_ITERATOR_MAP_INDEX));
|
||||
|
||||
// Assert: Type(array) is Object
|
||||
Assert(IsJSReceiverInstanceType(array_type));
|
||||
CSA_ASSERT(IsJSReceiverInstanceType(array_type));
|
||||
|
||||
Variable var_result(this, MachineRepresentation::kTagged);
|
||||
Variable var_map_index(this, MachineType::PointerRepresentation());
|
||||
@ -8500,9 +8503,9 @@ compiler::Node* CodeStubAssembler::CreateArrayIterator(
|
||||
Node* map_index =
|
||||
IntPtrAdd(IntPtrConstant(kBaseMapIndex + kFastIteratorOffset),
|
||||
LoadMapElementsKind(array_map));
|
||||
Assert(IntPtrGreaterThanOrEqual(
|
||||
CSA_ASSERT(IntPtrGreaterThanOrEqual(
|
||||
map_index, IntPtrConstant(kBaseMapIndex + kFastIteratorOffset)));
|
||||
Assert(IntPtrLessThan(
|
||||
CSA_ASSERT(IntPtrLessThan(
|
||||
map_index, IntPtrConstant(kBaseMapIndex + kSlowIteratorOffset)));
|
||||
|
||||
var_map_index.Bind(map_index);
|
||||
@ -8525,9 +8528,9 @@ compiler::Node* CodeStubAssembler::CreateArrayIterator(
|
||||
Node* map_index =
|
||||
IntPtrAdd(IntPtrConstant(kBaseMapIndex - UINT8_ELEMENTS),
|
||||
LoadMapElementsKind(array_map));
|
||||
Assert(IntPtrLessThan(
|
||||
CSA_ASSERT(IntPtrLessThan(
|
||||
map_index, IntPtrConstant(kBaseMapIndex + kFastIteratorOffset)));
|
||||
Assert(
|
||||
CSA_ASSERT(
|
||||
IntPtrGreaterThanOrEqual(map_index, IntPtrConstant(kBaseMapIndex)));
|
||||
var_map_index.Bind(map_index);
|
||||
var_array_map.Bind(UndefinedConstant());
|
||||
|
@ -707,7 +707,12 @@ class V8_EXPORT_PRIVATE CodeStubAssembler : public compiler::CodeAssembler {
|
||||
// Returns true if any of the |T|'s bits in given |word32| are set.
|
||||
template <typename T>
|
||||
compiler::Node* IsSetWord32(compiler::Node* word32) {
|
||||
return Word32NotEqual(Word32And(word32, Int32Constant(T::kMask)),
|
||||
return IsSetWord32(word32, T::kMask);
|
||||
}
|
||||
|
||||
// Returns true if any of the mask's bits in given |word32| are set.
|
||||
compiler::Node* IsSetWord32(compiler::Node* word32, uint32_t mask) {
|
||||
return Word32NotEqual(Word32And(word32, Int32Constant(mask)),
|
||||
Int32Constant(0));
|
||||
}
|
||||
|
||||
|
@ -49,6 +49,27 @@ try {
|
||||
assertTrue(/Object or null/.test(e));
|
||||
}
|
||||
|
||||
try {
|
||||
Object.create(null, this);
|
||||
assertTrue(false);
|
||||
} catch(e) {
|
||||
assertTrue(/Property description/.test(e))
|
||||
}
|
||||
|
||||
try {
|
||||
Object.create(null, [1, 2, 3]);
|
||||
assertTrue(false);
|
||||
} catch(e) {
|
||||
assertTrue(/Property description/.test(e))
|
||||
}
|
||||
|
||||
try {
|
||||
Object.create(null, new Proxy([1, 2, 3], {}));
|
||||
assertTrue(false);
|
||||
} catch(e) {
|
||||
assertTrue(/Property description/.test(e))
|
||||
}
|
||||
|
||||
var ctr = 0;
|
||||
var ctr2 = 0;
|
||||
var ctr3 = 0;
|
||||
|
Loading…
Reference in New Issue
Block a user