AuroraMiddleware/v8
1
0
Fork 0
Code Issues 2 Pull Requests Releases Wiki Activity

X87: [undetectable] Really get comparisons of document.all right now.

Browse Source 
port 679d9503cffe631cb3b938627274aea10893069c(r34608)

  original commit message:
  According to https://www.w3.org/TR/html5/obsolete.html#dom-document-all,
  comparisons of document.all to other values such as strings or objects,
  are unaffected. In fact document.all only gets special treatment in
  comparisons with null or undefined according to HTML. Especially setting
  the undetectable doesn't make two distinct JSReceivers equal.

BUG=

Review URL: https://codereview.chromium.org/1784763002

Cr-Commit-Position: refs/heads/master@{#34650}
This commit is contained in:
zhengxing.li 2016-03-09 22:11:41 -08:00 committed by Commit bot
parent 0f8cb27ef0
commit 92eb11e959
1 changed files with 12 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

14
src/x87/code-stubs-x87.cc
View File

@ -1112,7 +1112,7 @@ void CompareICStub::GenerateGeneric(MacroAssembler* masm) {
// Non-strict equality. Objects are unequal if
// they are both JSObjects and not undetectable,
// and their pointers are different.
Label return_unequal, undetectable;
Label return_equal, return_unequal, undetectable;
// At most one is a smi, so we can test for smi by adding the two.
// A smi plus a heap object has the low bit set, a heap object plus
// a heap object has the low bit clear.
@ -1120,7 +1120,7 @@ void CompareICStub::GenerateGeneric(MacroAssembler* masm) {
STATIC_ASSERT(kSmiTagMask == 1);
__ lea(ecx, Operand(eax, edx, times_1, 0));
__ test(ecx, Immediate(kSmiTagMask));
__ j(not_zero, &runtime_call, Label::kNear);
__ j(not_zero, &runtime_call);
__ mov(ecx, FieldOperand(eax, HeapObject::kMapOffset));
__ mov(ebx, FieldOperand(edx, HeapObject::kMapOffset));
@ -1145,6 +1145,16 @@ void CompareICStub::GenerateGeneric(MacroAssembler* masm) {
__ test_b(FieldOperand(ecx, Map::kBitFieldOffset),
1 << Map::kIsUndetectable);
__ j(zero, &return_unequal, Label::kNear);
// If both sides are JSReceivers, then the result is false according to
// the HTML specification, which says that only comparisons with null or
// undefined are affected by special casing for document.all.
__ CmpInstanceType(ebx, ODDBALL_TYPE);
__ j(zero, &return_equal, Label::kNear);
__ CmpInstanceType(ecx, ODDBALL_TYPE);
__ j(not_zero, &return_unequal, Label::kNear);
__ bind(&return_equal);
__ Move(eax, Immediate(EQUAL));
__ ret(0); // eax, edx were pushed
}