Author: [email protected]
Date: Sun May 10 22:33:27 2009
New Revision: 1905
Modified:
branches/1.1/src/api.cc
branches/1.1/src/virtual-frame-ia32.cc
Log:
Merge bleeding edge revision 1904 to 1.1 branch. This fixes code
generator crash.
Review URL: http://codereview.chromium.org/115177
Modified: branches/1.1/src/api.cc
==============================================================================
--- branches/1.1/src/api.cc (original)
+++ branches/1.1/src/api.cc Sun May 10 22:33:27 2009
@@ -2373,7 +2373,7 @@
const char* v8::V8::GetVersion() {
- return "1.1.10.9";
+ return "1.1.10.10";
}
Modified: branches/1.1/src/virtual-frame-ia32.cc
==============================================================================
--- branches/1.1/src/virtual-frame-ia32.cc (original)
+++ branches/1.1/src/virtual-frame-ia32.cc Sun May 10 22:33:27 2009
@@ -637,6 +637,12 @@
InvalidateFrameSlotAt(index);
+ // InvalidateFrameSlotAt can potentially change any frame element, due
+ // to spilling registers to allocate temporaries in order to preserve
+ // the copy-on-write semantics of aliased elements. Reload top from
+ // the frame.
+ top = elements_[top_index];
+
if (top.is_copy()) {
// There are two cases based on the relative positions of the
// stored-to slot and the backing slot of the top element.
--~--~---------~--~----~------------~-------~--~----~
v8-dev mailing list
[email protected]
http://groups.google.com/group/v8-dev
-~----------~----~----~----~------~----~------~--~---
