From f6e02e195cf6b887204f896640b172741fe09d0f Mon Sep 17 00:00:00 2001 From: bmeurer Date: Mon, 2 Feb 2015 22:28:59 -0800 Subject: [PATCH] Compute the same hash for all NaN values. Both SameValue and SameValueZero consider different NaNs equal, so we better assign the same hash value to all NaNs. BUG=v8:3859 LOG=y R=verwaest@chromium.org Review URL: https://codereview.chromium.org/897593002 Cr-Commit-Position: refs/heads/master@{#26391} --- src/objects.cc | 4 +++- test/mjsunit/regress/regress-3859.js | 6 ++++++ 2 files changed, 9 insertions(+), 1 deletion(-) create mode 100644 test/mjsunit/regress/regress-3859.js diff --git a/src/objects.cc b/src/objects.cc index 8d7244b..28c6ebb 100644 --- a/src/objects.cc +++ b/src/objects.cc @@ -717,7 +717,9 @@ Object* Object::GetHash() { // The object is either a number, a name, an odd-ball, // a real JS object, or a Harmony proxy. if (IsNumber()) { - uint32_t hash = ComputeLongHash(double_to_uint64(Number())); + uint32_t hash = std::isnan(Number()) + ? Smi::kMaxValue + : ComputeLongHash(double_to_uint64(Number())); return Smi::FromInt(hash & Smi::kMaxValue); } if (IsName()) { diff --git a/test/mjsunit/regress/regress-3859.js b/test/mjsunit/regress/regress-3859.js new file mode 100644 index 0000000..3248ef1 --- /dev/null +++ b/test/mjsunit/regress/regress-3859.js @@ -0,0 +1,6 @@ +// Copyright 2015 the V8 project authors. All rights reserved. +// Use of this source code is governed by a BSD-style license that can be +// found in the LICENSE file. + +assertEquals(1, new Set([NaN, NaN, NaN]).size); +assertEquals(42, new Map([[NaN, 42]]).get(NaN)); -- 2.7.4