Fix FastAccessorAssembler inverted jump conditions

BUG=chromium:508898

Review-Url: https://codereview.chromium.org/2135153002
Cr-Commit-Position: refs/heads/master@{#37640}

src/fast-accessor-assembler.cc

@@ -120,7 +120,7 @@ void FastAccessorAssembler::CheckFlagSetOrReturnNull(ValueId value, int mask) {
       assembler_->Word32Equal(
           assembler_->Word32And(FromId(value), assembler_->Int32Constant(mask)),
           assembler_->Int32Constant(0)),
-      &pass, &fail);
+      &fail, &pass);
   assembler_->Bind(&fail);
   assembler_->Return(assembler_->NullConstant());
   assembler_->Bind(&pass);
@@ -154,7 +154,7 @@ void FastAccessorAssembler::CheckNotZeroOrJump(ValueId value_id,
   CodeStubAssembler::Label pass(assembler_.get());
   assembler_->Branch(
       assembler_->WordEqual(FromId(value_id), assembler_->IntPtrConstant(0)),
-      &pass, FromId(label_id));
+      FromId(label_id), &pass);
   assembler_->Bind(&pass);
 }
 

test/cctest/test-api-fast-accessor-builder.cc

@@ -189,9 +189,9 @@ TEST(FastAccessorOrReturnNull) {
   // CheckFlagSetOrReturnNull:
   CompileRun(FN_WARMUP("maskcheck", "return obj.maskcheck"));
   obj->SetAlignedPointerInInternalField(1, reinterpret_cast<void*>(0xf0));
-  ExpectInt32("maskcheck()", 42);
-  obj->SetAlignedPointerInInternalField(1, reinterpret_cast<void*>(0xfe));
   ExpectNull("maskcheck()");
+  obj->SetAlignedPointerInInternalField(1, reinterpret_cast<void*>(0xfe));
+  ExpectInt32("maskcheck()", 42);
 }
 
 
@@ -212,9 +212,9 @@ TEST(FastAccessorControlFlowWithLabels) {
     auto label = builder->MakeLabel();
     auto val = builder->LoadInternalField(builder->GetReceiver(), 0);
     builder->CheckNotZeroOrJump(val, label);
-    builder->ReturnValue(builder->IntegerConstant(0));
-    builder->SetLabel(label);
     builder->ReturnValue(builder->IntegerConstant(1));
+    builder->SetLabel(label);
+    builder->ReturnValue(builder->IntegerConstant(0));
     foo->SetAccessorProperty(v8_str("isnull"),
                              v8::FunctionTemplate::NewWithFastHandler(
                                  isolate, NativePropertyAccessor, builder));
@@ -262,9 +262,9 @@ TEST(FastAccessorLoad) {
     auto val = builder->LoadValue(
         builder->LoadInternalField(builder->GetReceiver(), 0), intval_offset);
     builder->CheckNotZeroOrJump(val, label);
-    builder->ReturnValue(builder->IntegerConstant(0));
-    builder->SetLabel(label);
     builder->ReturnValue(builder->IntegerConstant(1));
+    builder->SetLabel(label);
+    builder->ReturnValue(builder->IntegerConstant(0));
     foo->SetAccessorProperty(v8_str("nonzero"),
                              v8::FunctionTemplate::NewWithFastHandler(
                                  isolate, NativePropertyAccessor, builder));