Chromium Code Reviews
chromiumcodereview-hr@appspot.gserviceaccount.com (chromiumcodereview-hr) | Please choose your nickname with Settings | Help | Chromium Project | Gerrit Changes | Sign out
(37)

Issues Search
    My Issues | Starred     Open | Closed | All

Unified Diff: src/ic/arm/ic-arm.cc

Issue 1228063004: Fix keyed element access wrt string wrappers (Closed) Base URL: https://chromium.googlesource.com/v8/v8.git@master
Patch Set: typo Created 5 years, 5 months ago
Use n/p to move between diff chunks; N/P to move between comments. Draft comments are only viewable by you.
Jump to:
View side-by-side diff with in-line comments
Download patch
« src/ia32/macro-assembler-ia32.cc ('K') | « src/ia32/macro-assembler-ia32.cc ('k') | src/ic/arm64/ic-arm64.cc » ('j') | src/ic/arm64/ic-arm64.cc » ('J')
Expand Comments ('e') | Collapse Comments ('c') | Show Comments Hide Comments ('s')
Index: src/ic/arm/ic-arm.cc
diff --git a/src/ic/arm/ic-arm.cc b/src/ic/arm/ic-arm.cc
index a3b74ce9f3477b307f1d7524d8d4ab5d034fe451..9ad02d4c472e7992cebffa7e4576ca61cd14e40f 100644
--- a/src/ic/arm/ic-arm.cc
+++ b/src/ic/arm/ic-arm.cc
@@ -658,8 +658,11 @@ void KeyedStoreIC::GenerateMegamorphic(MacroAssembler* masm,
__ ldrb(r4, FieldMemOperand(receiver_map, Map::kInstanceTypeOffset));
__ cmp(r4, Operand(JS_ARRAY_TYPE));
__ b(eq, &array);
- // Check that the object is some kind of JSObject.
- __ cmp(r4, Operand(FIRST_JS_OBJECT_TYPE));
+ // Check that the object is some kind of JS object EXCEPT JS Value type. In
+ // the case that the object is a value-wrapper object, we enter the runtime
+ // system to make sure that indexing into string objects works as intended.
+ DCHECK(JS_VALUE_TYPE < JS_OBJECT_TYPE);
+ __ cmp(r4, Operand(JS_OBJECT_TYPE));
__ b(lt, &slow);
Jakob Kummerow 2015/07/13 15:00:58 s/lt/lo/ for unsigned comparison
// Object case: Check key against length in the elements array.
« src/ia32/macro-assembler-ia32.cc ('K') | « src/ia32/macro-assembler-ia32.cc ('k') | src/ic/arm64/ic-arm64.cc » ('j') | src/ic/arm64/ic-arm64.cc » ('J')

Powered by Google App Engine
This is Rietveld 408576698