AuroraMiddleware/v8
1
0
Fork 0
Code Issues 2 Pull Requests Releases Wiki Activity

[builtins] fix Torque fast-path for String.prototype.localeCompare

Browse Source 
The fast path has an early return if the two inputs are the same
object. However, this was missing the check that the receiver
is not undefined required by the spec.
This fixes it by first checking that the receiver is a string and
only afterwards checking for reference equality.

Bug: v8:12495
Change-Id: I4c5fc80e09060b013c94b05bbc9da504ddbb5206
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3386602
Auto-Submit: Tobias Tebbi <tebbi@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/main@{#78637}
This commit is contained in:
Tobias Tebbi 2022-01-13 16:26:34 +00:00 committed by V8 LUCI CQ
parent 8ee40cfc1f
commit f33e68ade1
2 changed files with 22 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
src/objects/intl-objects.tq
View File

@ -102,9 +102,9 @@ macro LocaleCompareFastPath<T1: type, T2: type>(
transitioning builtin StringFastLocaleCompare(implicit context: Context)(
localeCompareFn: JSFunction, left: JSAny, right: JSAny,
locales: JSAny): JSAny {
if (TaggedEqual(left, right)) return SmiConstant(0);
try {
const left = Cast<String>(left) otherwise Bailout;
if (TaggedEqual(left, right)) return SmiConstant(0);
StringToSlice(left) otherwise LeftOneByte, LeftTwoByte;
} label LeftOneByte(leftSlice: ConstSlice<char8>) {
try {

21
test/mjsunit/regress/regress-12495.js Normal file
View File

@ -0,0 +1,21 @@
// Copyright 2022 the V8 project authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
// Flags: --allow-natives-syntax
function opt() {
try {
Reflect.apply("".localeCompare, undefined, [undefined]);
return false;
} catch(e) {
return true;
}
}
%PrepareFunctionForOptimization(opt);
assertTrue(opt());
assertTrue(opt());
%OptimizeFunctionOnNextCall(opt);
assertTrue(opt());
assertTrue(opt());