commit 389539ca30406101971745820d3105e7f39bb772
author Benedikt Meurer <bmeurer@chromium.org> Mon Sep 11 11:35:09 2017
committer Benedikt Meurer <bmeurer@chromium.org> Tue Sep 12 12:46:46 2017
tree 6bfba8f9ffb932144a218a9786b826289e2ebc52
parent 1bb620f36dbbef05900a39cb763dbbac28f700f1

[turbofan] Fix type of String#indexOf and String#lastIndexOf.

The Typer put the wrong type on String#index and String#lastIndexOf
builtins, with an off by one on the upper bound.

Bug: chromium:762874
Change-Id: Ia4c29bc2e8e1c85b6a7ae0b99f8aaabf839a5932
Reviewed-on: https://chromium-review.googlesource.com/660000
Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Commit-Queue: Benedikt Meurer <bmeurer@chromium.org>
Cr-Original-Commit-Position: refs/heads/master@{#47942}(cherry picked from commit b8f144ec4fd1cd808f0d883668f355498b56d7fa)
Reviewed-on: https://chromium-review.googlesource.com/663338
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Cr-Commit-Position: refs/branch-heads/6.2@{#15}
Cr-Branched-From: efa2ac4129d30c7c72e84c16af3d20b44829f990-refs/heads/6.2.414@{#1}
Cr-Branched-From: a861ebb762a60bf5cc2a274faee3620abfb06311-refs/heads/master@{#47693}

src/compiler/typer.cc

diff --git a/src/compiler/typer.cc b/src/compiler/typer.cc
index 9fb73ae..edf1cb1 100644
--- a/src/compiler/typer.cc
+++ b/src/compiler/typer.cc
@@ -1453,7 +1453,7 @@
           return Type::String();
         case kStringIndexOf:
         case kStringLastIndexOf:
-          return Type::Range(-1.0, String::kMaxLength - 1.0, t->zone());
+          return Type::Range(-1.0, String::kMaxLength, t->zone());
         case kStringEndsWith:
         case kStringIncludes:
           return Type::Boolean();

test/mjsunit/regress/regress-crbug-762874-1.js

diff --git a/test/mjsunit/regress/regress-crbug-762874-1.js b/test/mjsunit/regress/regress-crbug-762874-1.js
new file mode 100644
index 0000000..ab1b7c1
--- /dev/null
+++ b/test/mjsunit/regress/regress-crbug-762874-1.js
@@ -0,0 +1,18 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+const maxLength = %StringMaxLength();
+const s = 'A'.repeat(maxLength);
+
+function foo(s) {
+  let x = s.indexOf("", maxLength);
+  return x === maxLength;
+}
+
+assertTrue(foo(s));
+assertTrue(foo(s));
+%OptimizeFunctionOnNextCall(foo);
+assertTrue(foo(s));

test/mjsunit/regress/regress-crbug-762874-2.js

diff --git a/test/mjsunit/regress/regress-crbug-762874-2.js b/test/mjsunit/regress/regress-crbug-762874-2.js
new file mode 100644
index 0000000..6d301b5
--- /dev/null
+++ b/test/mjsunit/regress/regress-crbug-762874-2.js
@@ -0,0 +1,18 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+const maxLength = %StringMaxLength();
+const s = 'A'.repeat(maxLength);
+
+function foo(s) {
+  let x = s.lastIndexOf("", maxLength);
+  return x === maxLength;
+}
+
+assertTrue(foo(s));
+assertTrue(foo(s));
+%OptimizeFunctionOnNextCall(foo);
+assertTrue(foo(s));