From 79aee39f24d6753ce6fbf36eb09f5fb63614e0d8 Mon Sep 17 00:00:00 2001 From: mstarzinger Date: Mon, 14 Nov 2016 04:44:12 -0800 Subject: [PATCH] [builtins] Fix pointer comparison in ToString builtin. This fixes the bogus {Word32Equal} comparison in the ToString builtin implementing Object.prototype.toString to be a pointer-size {WordEqual} comparison instead. Comparing just the lower half-word is insufficient on 64-bit architectures. R=jgruber@chromium.org TEST=mjsunit/regress/regress-crbug-664506 BUG=chromium:664506 Review-Url: https://codereview.chromium.org/2496043003 Cr-Commit-Position: refs/heads/master@{#40963} --- src/builtins/builtins-object.cc | 4 ++-- test/mjsunit/regress/regress-crbug-664506.js | 11 +++++++++++ 2 files changed, 13 insertions(+), 2 deletions(-) create mode 100644 test/mjsunit/regress/regress-crbug-664506.js diff --git a/src/builtins/builtins-object.cc b/src/builtins/builtins-object.cc index 01f5ad45863d..c037e11d4f4c 100644 --- a/src/builtins/builtins-object.cc +++ b/src/builtins/builtins-object.cc @@ -296,10 +296,10 @@ void Builtins::Generate_ObjectProtoToString(CodeStubAssembler* assembler) { Node* context = assembler->Parameter(3); assembler->GotoIf( - assembler->Word32Equal(receiver, assembler->UndefinedConstant()), + assembler->WordEqual(receiver, assembler->UndefinedConstant()), &return_undefined); - assembler->GotoIf(assembler->Word32Equal(receiver, assembler->NullConstant()), + assembler->GotoIf(assembler->WordEqual(receiver, assembler->NullConstant()), &return_null); assembler->GotoIf(assembler->TaggedIsSmi(receiver), &return_number); diff --git a/test/mjsunit/regress/regress-crbug-664506.js b/test/mjsunit/regress/regress-crbug-664506.js new file mode 100644 index 000000000000..b0bf5e7591d4 --- /dev/null +++ b/test/mjsunit/regress/regress-crbug-664506.js @@ -0,0 +1,11 @@ +// Copyright 2016 the V8 project authors. All rights reserved. +// Use of this source code is governed by a BSD-style license that can be +// found in the LICENSE file. + +// Flags: --expose-gc --predictable --random-seed=-1109634722 + +gc(); +gc(); +assertEquals("[object Object]", Object.prototype.toString.call({})); +gc(); +assertEquals("[object Array]", Object.prototype.toString.call([]));