Commit 2ca36cc3 authored by danno's avatar danno Committed by Commit bot

[stubs] Fix hole-related double bug in ArrayNoArgumentConstructor

BUG=chromium:613796
LOG=N

Review-Url: https://codereview.chromium.org/2002813002
Cr-Commit-Position: refs/heads/master@{#36425}
parent e2ef4da9
...@@ -691,12 +691,35 @@ Node* CodeStubAssembler::AllocateJSArray(ElementsKind kind, Node* array_map, ...@@ -691,12 +691,35 @@ Node* CodeStubAssembler::AllocateJSArray(ElementsKind kind, Node* array_map,
elements, FixedArray::kLengthOffset, elements, FixedArray::kLengthOffset,
mode == SMI_PARAMETERS ? capacity_node : SmiTag(capacity_node)); mode == SMI_PARAMETERS ? capacity_node : SmiTag(capacity_node));
Node* double_hole = Float64Constant(bit_cast<double>(kHoleNanInt64)); int const first_element_offset = FixedArray::kHeaderSize - kHeapObjectTag;
Node* hole = HeapConstant(Handle<HeapObject>(heap->the_hole_value())); Node* hole = HeapConstant(Handle<HeapObject>(heap->the_hole_value()));
Node* double_hole =
Is64() ? Int64Constant(kHoleNanInt64) : Int32Constant(kHoleNanLower32);
DCHECK_EQ(kHoleNanLower32, kHoleNanUpper32);
if (constant_capacity && capacity <= kElementLoopUnrollThreshold) { if (constant_capacity && capacity <= kElementLoopUnrollThreshold) {
for (int i = 0; i < capacity; ++i) { for (int i = 0; i < capacity; ++i) {
if (is_double) { if (is_double) {
StoreFixedDoubleArrayElement(elements, Int32Constant(i), double_hole); Node* offset = ElementOffsetFromIndex(Int32Constant(i), kind, mode,
first_element_offset);
// Don't use doubles to store the hole double, since manipulating the
// signaling NaN used for the hole in C++, e.g. with bit_cast, will
// change its value on ia32 (the x87 stack is used to return values
// and stores to the stack silently clear the signalling bit).
//
// TODO(danno): When we have a Float32/Float64 wrapper class that
// preserves double bits during manipulation, remove this code/change
// this to an indexed Float64 store.
if (Is64()) {
StoreNoWriteBarrier(MachineRepresentation::kWord64, elements, offset,
double_hole);
} else {
StoreNoWriteBarrier(MachineRepresentation::kWord32, elements, offset,
double_hole);
offset = ElementOffsetFromIndex(Int32Constant(i), kind, mode,
first_element_offset + kPointerSize);
StoreNoWriteBarrier(MachineRepresentation::kWord32, elements, offset,
double_hole);
}
} else { } else {
StoreFixedArrayElement(elements, Int32Constant(i), hole, StoreFixedArrayElement(elements, Int32Constant(i), hole,
SKIP_WRITE_BARRIER); SKIP_WRITE_BARRIER);
......
// Copyright 2016 the V8 project authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
(function() {
function f() {
return new Array();
}
var a = f();
a[0] = 0.5;
var b = f();
b[2] = 0.5;
assertEquals(undefined, b[0]);
})();
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment