BuildNumberToString: Check for undefined keys in the cache

BuildNumberToString: Check for undefined keys in the cache

BUG=chromium:368114
LOG=y
R=bmeurer@chromium.org

Committed: https://code.google.com/p/v8/source/detail?r=21586

[Jakob Kummerow, 2014-05-30 16:56:52]

PTAL.

We can't add a regression test because... long story :-)

But I have an idea how to add instrumentation that would have found this issue.

https://codereview.chromium.org/302063004/diff/20001/src/hydrogen.cc
File src/hydrogen.cc (left):

https://codereview.chromium.org/302063004/diff/20001/src/hydrogen.cc#oldcode1681
src/hydrogen.cc:1681: // SMIs and heap number, so it is sufficient to do a SMI
check here).
This comment is a lie! Unused entries in the cache are |undefined|.

https://codereview.chromium.org/302063004/diff/20001/src/hydrogen.cc#oldcode1686
src/hydrogen.cc:1686: // Check if values of key and object match.
This entire block is actually unchanged, just indented one level deeper.

[Benedikt Meurer, 2014-05-31 09:30:24]

Nice catch, LGTM.

Although I'd maybe avoid initializing the cache with undefined, and instead
initialize all entries with (0,"0") or something like that.

[Jakob Kummerow, 2014-05-31 14:12:06]

Committed patchset #1 manually as r21586 (presubmit successful).

[Jakob Kummerow, 2014-05-31 14:14:14]

On 2014/05/31 09:30:24, Benedikt Meurer wrote:
> Although I'd maybe avoid initializing the cache with undefined, and instead
> initialize all entries with (0,"0") or something like that.

Not that easy, because elsewhere we care about detecting collisions as opposed
to overwriting empty slots.