1e959c18cf7193e2f021245584a3c8f1f32f82c92kasperl@chromium.org// Copyright 2009 the V8 project authors. All rights reserved. 2e959c18cf7193e2f021245584a3c8f1f32f82c92kasperl@chromium.org// Redistribution and use in source and binary forms, with or without 3e959c18cf7193e2f021245584a3c8f1f32f82c92kasperl@chromium.org// modification, are permitted provided that the following conditions are 4e959c18cf7193e2f021245584a3c8f1f32f82c92kasperl@chromium.org// met: 5e959c18cf7193e2f021245584a3c8f1f32f82c92kasperl@chromium.org// 6e959c18cf7193e2f021245584a3c8f1f32f82c92kasperl@chromium.org// * Redistributions of source code must retain the above copyright 7e959c18cf7193e2f021245584a3c8f1f32f82c92kasperl@chromium.org// notice, this list of conditions and the following disclaimer. 8e959c18cf7193e2f021245584a3c8f1f32f82c92kasperl@chromium.org// * Redistributions in binary form must reproduce the above 9e959c18cf7193e2f021245584a3c8f1f32f82c92kasperl@chromium.org// copyright notice, this list of conditions and the following 10e959c18cf7193e2f021245584a3c8f1f32f82c92kasperl@chromium.org// disclaimer in the documentation and/or other materials provided 11e959c18cf7193e2f021245584a3c8f1f32f82c92kasperl@chromium.org// with the distribution. 12e959c18cf7193e2f021245584a3c8f1f32f82c92kasperl@chromium.org// * Neither the name of Google Inc. nor the names of its 13e959c18cf7193e2f021245584a3c8f1f32f82c92kasperl@chromium.org// contributors may be used to endorse or promote products derived 14e959c18cf7193e2f021245584a3c8f1f32f82c92kasperl@chromium.org// from this software without specific prior written permission. 15e959c18cf7193e2f021245584a3c8f1f32f82c92kasperl@chromium.org// 16e959c18cf7193e2f021245584a3c8f1f32f82c92kasperl@chromium.org// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS 17e959c18cf7193e2f021245584a3c8f1f32f82c92kasperl@chromium.org// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT 18e959c18cf7193e2f021245584a3c8f1f32f82c92kasperl@chromium.org// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR 19e959c18cf7193e2f021245584a3c8f1f32f82c92kasperl@chromium.org// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT 20e959c18cf7193e2f021245584a3c8f1f32f82c92kasperl@chromium.org// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, 21e959c18cf7193e2f021245584a3c8f1f32f82c92kasperl@chromium.org// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT 22e959c18cf7193e2f021245584a3c8f1f32f82c92kasperl@chromium.org// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, 23e959c18cf7193e2f021245584a3c8f1f32f82c92kasperl@chromium.org// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY 24e959c18cf7193e2f021245584a3c8f1f32f82c92kasperl@chromium.org// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT 25e959c18cf7193e2f021245584a3c8f1f32f82c92kasperl@chromium.org// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE 26e959c18cf7193e2f021245584a3c8f1f32f82c92kasperl@chromium.org// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 27e959c18cf7193e2f021245584a3c8f1f32f82c92kasperl@chromium.org 28e959c18cf7193e2f021245584a3c8f1f32f82c92kasperl@chromium.org// A HeapNumber with certain bits in the mantissa of the floating point 29e959c18cf7193e2f021245584a3c8f1f32f82c92kasperl@chromium.org// value should not be able to masquerade as a string in a keyed lookup 30e959c18cf7193e2f021245584a3c8f1f32f82c92kasperl@chromium.org// inline cache stub. See http://codereview.chromium.org/155924. 31e959c18cf7193e2f021245584a3c8f1f32f82c92kasperl@chromium.org 32e959c18cf7193e2f021245584a3c8f1f32f82c92kasperl@chromium.orgA = [ 0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10 ]; 33e959c18cf7193e2f021245584a3c8f1f32f82c92kasperl@chromium.org 34e959c18cf7193e2f021245584a3c8f1f32f82c92kasperl@chromium.orgfunction foo() { 35e959c18cf7193e2f021245584a3c8f1f32f82c92kasperl@chromium.org x = 1 << 26; 36e959c18cf7193e2f021245584a3c8f1f32f82c92kasperl@chromium.org x = x * x; 37e959c18cf7193e2f021245584a3c8f1f32f82c92kasperl@chromium.org // The following floating-point heap number has a second word similar 38e959c18cf7193e2f021245584a3c8f1f32f82c92kasperl@chromium.org // to that of the string "5": 39e959c18cf7193e2f021245584a3c8f1f32f82c92kasperl@chromium.org // 2^52 + index << cached_index_shift + cached_index_tag 40e959c18cf7193e2f021245584a3c8f1f32f82c92kasperl@chromium.org x = x + (5 << 2) + (1 << 1); 41e959c18cf7193e2f021245584a3c8f1f32f82c92kasperl@chromium.org return A[x]; 42e959c18cf7193e2f021245584a3c8f1f32f82c92kasperl@chromium.org} 43e959c18cf7193e2f021245584a3c8f1f32f82c92kasperl@chromium.org 44e959c18cf7193e2f021245584a3c8f1f32f82c92kasperl@chromium.orgassertEquals(undefined, foo(), "First lookup A[bad_float]"); 45e959c18cf7193e2f021245584a3c8f1f32f82c92kasperl@chromium.orgassertEquals(undefined, foo(), "Second lookup A[bad_float]"); 46e959c18cf7193e2f021245584a3c8f1f32f82c92kasperl@chromium.orgassertEquals(undefined, foo(), "Third lookup A[bad_float]"); 47