Reviewers: Erik Corry, Message: The change in ia32 is not necessary, but might avoid the same problem when porting to a different platform.
Description: X64: Fix bug introduced in revision 2779 Please review this at http://codereview.chromium.org/180040 SVN Base: http://v8.googlecode.com/svn/branches/bleeding_edge/ Affected files: M src/ia32/ic-ia32.cc M src/x64/ic-x64.cc Index: src/ia32/ic-ia32.cc =================================================================== --- src/ia32/ic-ia32.cc (revision 2786) +++ src/ia32/ic-ia32.cc (working copy) @@ -604,7 +604,7 @@ __ mov(ebx, FieldOperand(edx, HeapObject::kMapOffset)); __ movzx_b(eax, FieldOperand(ebx, Map::kInstanceTypeOffset)); __ cmp(eax, FIRST_JS_OBJECT_TYPE); - __ j(less, &miss, not_taken); + __ j(below, &miss, not_taken); // If this assert fails, we have to check upper bound too. ASSERT(LAST_TYPE == JS_FUNCTION_TYPE); Index: src/x64/ic-x64.cc =================================================================== --- src/x64/ic-x64.cc (revision 2786) +++ src/x64/ic-x64.cc (working copy) @@ -849,7 +849,7 @@ // Check that the receiver is a valid JS object. __ CmpObjectType(rax, FIRST_JS_OBJECT_TYPE, rbx); - __ j(less, &miss); + __ j(below, &miss); // If this assert fails, we have to check upper bound too. ASSERT(LAST_TYPE == JS_FUNCTION_TYPE); --~--~---------~--~----~------------~-------~--~----~ v8-dev mailing list [email protected] http://groups.google.com/group/v8-dev -~----------~----~----~----~------~----~------~--~---
