[turbofan] Fix type of String#indexOf and String#lastIndexOf.

bmeurer · Commit Bot · commit b8f144ec4fd1 · 2017-09-11T12:05:29.000Z
The Typer put the wrong type on String#index and String#lastIndexOf builtins, with an off by one on the upper bound. Bug: chromium:762874 Change-Id: Ia4c29bc2e8e1c85b6a7ae0b99f8aaabf839a5932 Reviewed-on: https://chromium-review.googlesource.com/660000 Reviewed-by: Jaroslav Sevcik <jarin@chromium.org> Commit-Queue: Benedikt Meurer <bmeurer@chromium.org> Cr-Commit-Position: refs/heads/master@{#47942}
diff --git a/src/compiler/typer.cc b/src/compiler/typer.cc
@@ -1453,7 +1453,7 @@ Type* Typer::Visitor::JSCallTyper(Type* fun, Typer* t) {
           return Type::String();
         case kStringIndexOf:
         case kStringLastIndexOf:
-          return Type::Range(-1.0, String::kMaxLength - 1.0, t->zone());
+          return Type::Range(-1.0, String::kMaxLength, t->zone());
         case kStringEndsWith:
         case kStringIncludes:
           return Type::Boolean();
diff --git a/test/mjsunit/regress/regress-crbug-762874-1.js b/test/mjsunit/regress/regress-crbug-762874-1.js
@@ -0,0 +1,18 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+const maxLength = %StringMaxLength();
+const s = 'A'.repeat(maxLength);
+
+function foo(s) {
+  let x = s.indexOf("", maxLength);
+  return x === maxLength;
+}
+
+assertTrue(foo(s));
+assertTrue(foo(s));
+%OptimizeFunctionOnNextCall(foo);
+assertTrue(foo(s));
diff --git a/test/mjsunit/regress/regress-crbug-762874-2.js b/test/mjsunit/regress/regress-crbug-762874-2.js
@@ -0,0 +1,18 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+const maxLength = %StringMaxLength();
+const s = 'A'.repeat(maxLength);
+
+function foo(s) {
+  let x = s.lastIndexOf("", maxLength);
+  return x === maxLength;
+}
+
+assertTrue(foo(s));
+assertTrue(foo(s));
+%OptimizeFunctionOnNextCall(foo);
+assertTrue(foo(s));
