Skip to content
Permalink
Browse files

[turbofan] Fix type of String#indexOf and String#lastIndexOf.

The Typer put the wrong type on String#index and String#lastIndexOf
builtins, with an off by one on the upper bound.

Bug: chromium:762874
Change-Id: Ia4c29bc2e8e1c85b6a7ae0b99f8aaabf839a5932
Reviewed-on: https://chromium-review.googlesource.com/660000
Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Commit-Queue: Benedikt Meurer <bmeurer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#47942}
  • Loading branch information...
bmeurer authored and Commit Bot committed Sep 11, 2017
1 parent d2da19c commit b8f144ec4fd1cd808f0d883668f355498b56d7fa
@@ -1453,7 +1453,7 @@ Type* Typer::Visitor::JSCallTyper(Type* fun, Typer* t) {
return Type::String();
case kStringIndexOf:
case kStringLastIndexOf:
return Type::Range(-1.0, String::kMaxLength - 1.0, t->zone());
return Type::Range(-1.0, String::kMaxLength, t->zone());
case kStringEndsWith:
case kStringIncludes:
return Type::Boolean();
@@ -0,0 +1,18 @@
// Copyright 2017 the V8 project authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.

// Flags: --allow-natives-syntax

const maxLength = %StringMaxLength();
const s = 'A'.repeat(maxLength);

function foo(s) {
let x = s.indexOf("", maxLength);
return x === maxLength;
}

assertTrue(foo(s));
assertTrue(foo(s));
%OptimizeFunctionOnNextCall(foo);
assertTrue(foo(s));
@@ -0,0 +1,18 @@
// Copyright 2017 the V8 project authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.

// Flags: --allow-natives-syntax

const maxLength = %StringMaxLength();
const s = 'A'.repeat(maxLength);

function foo(s) {
let x = s.lastIndexOf("", maxLength);
return x === maxLength;
}

assertTrue(foo(s));
assertTrue(foo(s));
%OptimizeFunctionOnNextCall(foo);
assertTrue(foo(s));

0 comments on commit b8f144e

Please sign in to comment.
You can’t perform that action at this time.