Reviewers: William Hesse, Description: Push 64-bit crash fix to trunk.
Please review this at http://codereview.chromium.org/204038 SVN Base: http://v8.googlecode.com/svn/trunk/ Affected files: M src/version.cc M src/x64/codegen-x64.cc M test/mjsunit/array-splice.js Index: test/mjsunit/array-splice.js =================================================================== --- test/mjsunit/array-splice.js (revision 2900) +++ test/mjsunit/array-splice.js (working copy) @@ -309,3 +309,6 @@ assertEquals(1, arr.pop()); assertEquals(0, arr.pop()); Array.prototype[1] = undefined; + +// Test http://code.google.com/p/chromium/issues/detail?id=21860 +Array.prototype.push.apply([], [1].splice(0, -(-1 % 5))); Index: src/x64/codegen-x64.cc =================================================================== --- src/x64/codegen-x64.cc (revision 2900) +++ src/x64/codegen-x64.cc (working copy) @@ -6320,7 +6320,7 @@ // Also enter it if the value of the smi is Smi::kMinValue __ testl(rax, Immediate(0x7FFFFFFE)); __ j(zero, &special); - __ neg(rax); + __ negl(rax); __ jmp(&done); __ bind(&special); Index: src/version.cc =================================================================== --- src/version.cc (revision 2900) +++ src/version.cc (working copy) @@ -35,7 +35,7 @@ #define MAJOR_VERSION 1 #define MINOR_VERSION 3 #define BUILD_NUMBER 11 -#define PATCH_LEVEL 0 +#define PATCH_LEVEL 1 #define CANDIDATE_VERSION false // Define SONAME to have the SCons build the put a specific SONAME into the --~--~---------~--~----~------------~-------~--~----~ v8-dev mailing list [email protected] http://groups.google.com/group/v8-dev -~----------~----~----~----~------~----~------~--~---
