AuroraMiddleware/v8
1
0
Fork 0
Code Issues 2 Pull Requests Releases Wiki Activity

Bugfix in inlined versions of Array.indexOf() and Array.lastIndexOf() with a regression test.

Browse Source 
BUG=chromium:381534
LOG=N
R=bmeurer@chromium.org

Review URL: https://codereview.chromium.org/319343002

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@21733 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
This commit is contained in:
ishell@chromium.org 2014-06-10 09:01:45 +00:00
parent ec57abdaa7
commit 6dc967e2e0
3 changed files with 72 additions and 23 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
src/hydrogen-instructions.cc
View File

@ -1540,7 +1540,10 @@ HInstruction* HForceRepresentation::New(Zone* zone, HValue* context,
HConstant* c = HConstant::cast(value);
if (c->HasNumberValue()) {
double double_res = c->DoubleValue();
if (representation.CanContainDouble(double_res)) {
if (representation.IsDouble()) {
return HConstant::New(zone, context, double_res);
} else if (representation.CanContainDouble(double_res)) {
return HConstant::New(zone, context,
static_cast<int32_t>(double_res),
representation);

36
src/hydrogen.cc
View File

@ -8524,28 +8524,32 @@ HValue* HOptimizedGraphBuilder::BuildArrayIndexOf(HValue* receiver,
}
if_isstring.Else();
{
IfBuilder if_isheapnumber(this);
if_isheapnumber.IfNot<HIsSmiAndBranch>(search_element);
HCompareMap* isheapnumber = if_isheapnumber.AndIf<HCompareMap>(
IfBuilder if_isnumber(this);
if_isnumber.If<HIsSmiAndBranch>(search_element);
if_isnumber.OrIf<HCompareMap>(
search_element, isolate()->factory()->heap_number_map());
if_isheapnumber.Then();
if_isnumber.Then();
{
HValue* search_number = Add<HLoadNamedField>(
search_element, isheapnumber,
HObjectAccess::ForHeapNumberValue());
HValue* search_number =
AddUncasted<HForceRepresentation>(search_element,
Representation::Double());
LoopBuilder loop(this, context(), direction);
{
HValue* index = loop.BeginBody(initial, terminating, token);
HValue* element = AddUncasted<HLoadKeyed>(
elements, index, static_cast<HValue*>(NULL),
kind, ALLOW_RETURN_HOLE);
IfBuilder if_issame(this);
if_issame.IfNot<HIsSmiAndBranch>(element);
HCompareMap* issame = if_issame.AndIf<HCompareMap>(
IfBuilder if_element_isnumber(this);
if_element_isnumber.If<HIsSmiAndBranch>(element);
if_element_isnumber.OrIf<HCompareMap>(
element, isolate()->factory()->heap_number_map());
if_issame.And();
HValue* number = Add<HLoadNamedField>(
element, issame, HObjectAccess::ForHeapNumberValue());
if_element_isnumber.Then();
{
HValue* number =
AddUncasted<HForceRepresentation>(element,
Representation::Double());
IfBuilder if_issame(this);
if_issame.If<HCompareNumericAndBranch>(
number, search_number, Token::EQ_STRICT);
if_issame.Then();
@ -8556,9 +8560,11 @@ HValue* HOptimizedGraphBuilder::BuildArrayIndexOf(HValue* receiver,
}
if_issame.End();
}
if_element_isnumber.End();
}
loop.EndBody();
}
if_isheapnumber.Else();
if_isnumber.Else();
{
LoopBuilder loop(this, context(), direction);
{
@ -8579,7 +8585,7 @@ HValue* HOptimizedGraphBuilder::BuildArrayIndexOf(HValue* receiver,
}
loop.EndBody();
}
if_isheapnumber.End();
if_isnumber.End();
}
if_isstring.End();
}

40
test/mjsunit/regress/regress-crbug-381534.js Normal file
View File

@ -0,0 +1,40 @@
// Copyright 2014 the V8 project authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
// Flags: --allow-natives-syntax
var obj = {};
function f(v) {
var v1 = -(4/3);
var v2 = 1;
var arr = new Array(+0, true, 0, -0, false, undefined, null, "0", obj, v1, -(4/3), -1.3333333333333, "str", v2, 1, false);
assertEquals(10, arr.lastIndexOf(-(4/3)));
assertEquals(9, arr.indexOf(-(4/3)));
assertEquals(10, arr.lastIndexOf(v));
assertEquals(9, arr.indexOf(v));
assertEquals(8, arr.lastIndexOf(obj));
assertEquals(8, arr.indexOf(obj));
}
function g(v, x, index) {
var arr = new Array({}, x-1.1, x-2, x-3.1);
assertEquals(index, arr.indexOf(0));
assertEquals(index, arr.lastIndexOf(0));
assertEquals(index, arr.indexOf(v));
assertEquals(index, arr.lastIndexOf(v));
}
f(-(4/3));
f(-(4/3));
%OptimizeFunctionOnNextCall(f);
f(-(4/3));
g(0, 2, 2);
g(0, 3.1, 3);
%OptimizeFunctionOnNextCall(g);
g(0, 1.1, 1);