Reviewers: Kevin Millikin, Description: Merge bleeding edge revision 1904 to 1.1 branch. This fixes code generator crash.
Please review this at http://codereview.chromium.org/115177 SVN Base: http://v8.googlecode.com/svn/branches/1.1/ Affected files: M src/api.cc M src/virtual-frame-ia32.cc Index: src/api.cc =================================================================== --- src/api.cc (revision 1904) +++ src/api.cc (working copy) @@ -2373,7 +2373,7 @@ const char* v8::V8::GetVersion() { - return "1.1.10.9"; + return "1.1.10.10"; } Index: src/virtual-frame-ia32.cc =================================================================== --- src/virtual-frame-ia32.cc (revision 1904) +++ src/virtual-frame-ia32.cc (working copy) @@ -637,6 +637,12 @@ InvalidateFrameSlotAt(index); + // InvalidateFrameSlotAt can potentially change any frame element, due + // to spilling registers to allocate temporaries in order to preserve + // the copy-on-write semantics of aliased elements. Reload top from + // the frame. + top = elements_[top_index]; + if (top.is_copy()) { // There are two cases based on the relative positions of the // stored-to slot and the backing slot of the top element. --~--~---------~--~----~------------~-------~--~----~ v8-dev mailing list [email protected] http://groups.google.com/group/v8-dev -~----------~----~----~----~------~----~------~--~---
