AuroraMiddleware/v8
1
0
Fork 0
Code Issues 2 Pull Requests Releases Wiki Activity

Remove buggy ToNumber truncation

Browse Source 
BUG=v8:2813
R=danno@chromium.org

Review URL: https://codereview.chromium.org/21531003

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@16008 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
This commit is contained in:
jkummerow@chromium.org 2013-08-01 16:12:31 +00:00
parent 4de5d18077
commit 61f531cf23
1 changed files with 0 additions and 20 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

20
src/hydrogen.cc
View File

@ -7679,26 +7679,6 @@ HValue* HGraphBuilder::TruncateToNumber(HValue* value, Handle<Type>* expected) {
*expected = handle(Type::Number(), isolate());
return AddInstruction(number.value);
}
return value;
}
Handle<Type> expected_type = *expected;
Representation rep = Representation::FromType(expected_type);
if (!rep.IsTagged()) return value;
// If our type feedback suggests that we can non-observably truncate to number
// we introduce the appropriate check here. This avoids 'value' having a
// tagged representation later on.
if (expected_type->Is(Type::Oddball())) {
// TODO(olivf) The BinaryOpStub only records undefined. It might pay off to
// also record booleans and convert them to 0/1 here.
IfBuilder if_nan(this);
if_nan.If<HCompareObjectEqAndBranch>(value,
graph()->GetConstantUndefined());
if_nan.Then();
if_nan.ElseDeopt();
if_nan.End();
return Add<HConstant>(OS::nan_value());
}
return value;