Compute the same hash for all NaN values.

Both SameValue and SameValueZero consider different NaNs equal, so we
better assign the same hash value to all NaNs.

BUG=v8:3859
LOG=y
R=verwaest@chromium.org

Review URL: https://codereview.chromium.org/897593002

Cr-Commit-Position: refs/heads/master@{#26391}

diff --git a/src/objects.cc b/src/objects.cc
index 8d7244b..28c6ebb 100644 (file)
--- a/src/objects.cc
+++ b/src/objects.cc
@@ -717,7 +717,9 @@ Object* Object::GetHash() {
   // The object is either a number, a name, an odd-ball,
   // a real JS object, or a Harmony proxy.
   if (IsNumber()) {
-    uint32_t hash = ComputeLongHash(double_to_uint64(Number()));
+    uint32_t hash = std::isnan(Number())
+                        ? Smi::kMaxValue
+                        : ComputeLongHash(double_to_uint64(Number()));
     return Smi::FromInt(hash & Smi::kMaxValue);
   }
   if (IsName()) {

diff --git a/test/mjsunit/regress/regress-3859.js b/test/mjsunit/regress/regress-3859.js
new file mode 100644 (file)
index 0000000..3248ef1
--- /dev/null
+++ b/test/mjsunit/regress/regress-3859.js
@@ -0,0 +1,6 @@
+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+assertEquals(1, new Set([NaN, NaN, NaN]).size);
+assertEquals(42, new Map([[NaN, 42]]).get(NaN));