Commit 09572410 authored by bmeurer's avatar bmeurer Committed by Commit bot

[crankshaft] Fix abstract equality for receivers.

We need to check both sides for abstract equality of receivers in optimized
code, otherwise we don't handle implicit conversions and undetectable
objects correctly.

R=jarin@chromium.org
BUG=v8:5802

Review-Url: https://codereview.chromium.org/2612213002
Cr-Commit-Position: refs/heads/master@{#42085}
parent 10453e85
......@@ -11286,23 +11286,35 @@ HControlInstruction* HOptimizedGraphBuilder::BuildCompareInstruction(
// The caller expects a branch instruction, so make it happy.
return New<HBranch>(graph()->GetConstantTrue());
}
// Can we get away with map check and not instance type check?
HValue* operand_to_check =
left->block()->block_id() < right->block()->block_id() ? left : right;
if (combined_type->IsClass()) {
Handle<Map> map = combined_type->AsClass()->Map();
AddCheckMap(operand_to_check, map);
HCompareObjectEqAndBranch* result =
New<HCompareObjectEqAndBranch>(left, right);
return result;
if (op == Token::EQ) {
// For abstract equality we need to check both sides are receivers.
if (combined_type->IsClass()) {
Handle<Map> map = combined_type->AsClass()->Map();
AddCheckMap(left, map);
AddCheckMap(right, map);
} else {
BuildCheckHeapObject(left);
Add<HCheckInstanceType>(left, HCheckInstanceType::IS_JS_RECEIVER);
BuildCheckHeapObject(right);
Add<HCheckInstanceType>(right, HCheckInstanceType::IS_JS_RECEIVER);
}
} else {
BuildCheckHeapObject(operand_to_check);
Add<HCheckInstanceType>(operand_to_check,
HCheckInstanceType::IS_JS_RECEIVER);
HCompareObjectEqAndBranch* result =
New<HCompareObjectEqAndBranch>(left, right);
return result;
// For strict equality we only need to check one side.
HValue* operand_to_check =
left->block()->block_id() < right->block()->block_id() ? left
: right;
if (combined_type->IsClass()) {
Handle<Map> map = combined_type->AsClass()->Map();
AddCheckMap(operand_to_check, map);
} else {
BuildCheckHeapObject(operand_to_check);
Add<HCheckInstanceType>(operand_to_check,
HCheckInstanceType::IS_JS_RECEIVER);
}
}
HCompareObjectEqAndBranch* result =
New<HCompareObjectEqAndBranch>(left, right);
return result;
} else {
if (combined_type->IsClass()) {
// TODO(bmeurer): This is an optimized version of an x < y, x > y,
......
// Copyright 2017 the V8 project authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
// Flags: --allow-natives-syntax
(function() {
function eq(a, b) { return a == b; }
var o = { [Symbol.toPrimitive]: () => "o" };
assertTrue(eq(o, o));
%BaselineFunctionOnNextCall(eq);
assertTrue(eq(o, o));
%OptimizeFunctionOnNextCall(eq);
assertTrue(eq(o, o));
assertTrue(eq("o", o));
assertTrue(eq(o, "o"));
%OptimizeFunctionOnNextCall(eq);
assertTrue(eq(o, o));
assertTrue(eq("o", o));
assertTrue(eq(o, "o"));
assertOptimized(eq);
})();
(function() {
function ne(a, b) { return a != b; }
var o = { [Symbol.toPrimitive]: () => "o" };
assertFalse(ne(o, o));
%BaselineFunctionOnNextCall(ne);
assertFalse(ne(o, o));
%OptimizeFunctionOnNextCall(ne);
assertFalse(ne(o, o));
assertFalse(ne("o", o));
assertFalse(ne(o, "o"));
%OptimizeFunctionOnNextCall(ne);
assertFalse(ne(o, o));
assertFalse(ne("o", o));
assertFalse(ne(o, "o"));
assertOptimized(ne);
})();
(function() {
function eq(a, b) { return a == b; }
var a = {};
var b = {b};
var u = %GetUndetectable();
assertTrue(eq(a, a));
assertTrue(eq(b, b));
assertFalse(eq(a, b));
assertFalse(eq(b, a));
%BaselineFunctionOnNextCall(eq);
assertTrue(eq(a, a));
assertTrue(eq(b, b));
assertFalse(eq(a, b));
assertFalse(eq(b, a));
%OptimizeFunctionOnNextCall(eq);
assertTrue(eq(a, a));
assertTrue(eq(b, b));
assertFalse(eq(a, b));
assertFalse(eq(b, a));
assertTrue(eq(null, u));
assertTrue(eq(undefined, u));
assertTrue(eq(u, null));
assertTrue(eq(u, undefined));
%OptimizeFunctionOnNextCall(eq);
assertTrue(eq(a, a));
assertTrue(eq(b, b));
assertFalse(eq(a, b));
assertFalse(eq(b, a));
assertTrue(eq(null, u));
assertTrue(eq(undefined, u));
assertTrue(eq(u, null));
assertTrue(eq(u, undefined));
assertOptimized(eq);
})();
(function() {
function ne(a, b) { return a != b; }
var a = {};
var b = {b};
var u = %GetUndetectable();
assertFalse(ne(a, a));
assertFalse(ne(b, b));
assertTrue(ne(a, b));
assertTrue(ne(b, a));
%BaselineFunctionOnNextCall(ne);
assertFalse(ne(a, a));
assertFalse(ne(b, b));
assertTrue(ne(a, b));
assertTrue(ne(b, a));
%OptimizeFunctionOnNextCall(ne);
assertFalse(ne(a, a));
assertFalse(ne(b, b));
assertTrue(ne(a, b));
assertTrue(ne(b, a));
assertFalse(ne(null, u));
assertFalse(ne(undefined, u));
assertFalse(ne(u, null));
assertFalse(ne(u, undefined));
%OptimizeFunctionOnNextCall(ne);
assertFalse(ne(a, a));
assertFalse(ne(b, b));
assertTrue(ne(a, b));
assertTrue(ne(b, a));
assertFalse(ne(null, u));
assertFalse(ne(undefined, u));
assertFalse(ne(u, null));
assertFalse(ne(u, undefined));
assertOptimized(ne);
})();
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment