From 928a1bff32988c04ec8b049b6739b43ed0d2186d Mon Sep 17 00:00:00 2001 From: "mstarzinger@chromium.org" Date: Mon, 18 Jun 2012 14:21:29 +0000 Subject: [PATCH] Fix handling of numbers in SameValue method. R=vegorov@chromium.org BUG=v8:2186 TEST=mjsunit/regress/regress-2186 Review URL: https://chromiumcodereview.appspot.com/10532198 git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@11853 ce2b1a6d-e550-0410-aec6-3dcde31c8c00 --- src/objects.cc | 1 - test/mjsunit/regress/regress-2186.js | 49 ++++++++++++++++++++++++++++++++++++ 2 files changed, 49 insertions(+), 1 deletion(-) create mode 100644 test/mjsunit/regress/regress-2186.js diff --git a/src/objects.cc b/src/objects.cc index 3b2db22..3466dcf 100644 --- a/src/objects.cc +++ b/src/objects.cc @@ -763,7 +763,6 @@ MaybeObject* Object::GetHash(CreationFlag flag) { bool Object::SameValue(Object* other) { if (other == this) return true; - if (!IsHeapObject() || !other->IsHeapObject()) return false; // The object is either a number, a string, an odd-ball, // a real JS object, or a Harmony proxy. diff --git a/test/mjsunit/regress/regress-2186.js b/test/mjsunit/regress/regress-2186.js new file mode 100644 index 0000000..0921dce --- /dev/null +++ b/test/mjsunit/regress/regress-2186.js @@ -0,0 +1,49 @@ +// Copyright 2012 the V8 project authors. All rights reserved. +// Redistribution and use in source and binary forms, with or without +// modification, are permitted provided that the following conditions are +// met: +// +// * Redistributions of source code must retain the above copyright +// notice, this list of conditions and the following disclaimer. +// * Redistributions in binary form must reproduce the above +// copyright notice, this list of conditions and the following +// disclaimer in the documentation and/or other materials provided +// with the distribution. +// * Neither the name of Google Inc. nor the names of its +// contributors may be used to endorse or promote products derived +// from this software without specific prior written permission. +// +// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS +// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT +// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR +// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT +// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, +// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT +// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, +// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY +// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT +// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE +// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. + +// Flags: --harmony-collections + +function heapify(i) { + return 2.0 * (i / 2); +} +heapify(1); + +var ONE = 1; +var ANOTHER_ONE = heapify(ONE); +assertSame(ONE, ANOTHER_ONE); +assertEquals("number", typeof ONE); +assertEquals("number", typeof ANOTHER_ONE); + +var set = new Set; +set.add(ONE); +assertTrue(set.has(ONE)); +assertTrue(set.has(ANOTHER_ONE)); + +var map = new Map; +map.set(ONE, 23); +assertSame(23, map.get(ONE)); +assertSame(23, map.get(ANOTHER_ONE)); -- 2.7.4