AuroraMiddleware/v8
1
0
Fork 0
Code Issues 2 Pull Requests Releases Wiki Activity

Fix missing smi check in inlined indexOf/lastIndexOf.

Browse Source 
BUG=382513
LOG=y
R=danno@chromium.org

Review URL: https://codereview.chromium.org/313233005

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@21727 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
This commit is contained in:
bmeurer@chromium.org 2014-06-10 04:26:15 +00:00
parent 6ea90a4783
commit 7eea77bc5c
2 changed files with 13 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
src/hydrogen.cc
View File

@ -8538,7 +8538,8 @@ HValue* HOptimizedGraphBuilder::BuildArrayIndexOf(HValue* receiver,
elements, index, static_cast<HValue*>(NULL),
kind, ALLOW_RETURN_HOLE);
IfBuilder if_issame(this);
HCompareMap* issame = if_issame.If<HCompareMap>(
if_issame.IfNot<HIsSmiAndBranch>(element);
HCompareMap* issame = if_issame.AndIf<HCompareMap>(
element, isolate()->factory()->heap_number_map());
if_issame.And();
HValue* number = Add<HLoadNamedField>(

11
test/mjsunit/regress/regress-crbug-382513.js Normal file
View File

@ -0,0 +1,11 @@
// Copyright 2014 the V8 project authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
// Flags: --allow-natives-syntax
function foo() { return [+0,false].indexOf(-(4/3)); }
foo();
foo();
%OptimizeFunctionOnNextCall(foo);
foo();