Revision: 2901 Author: [email protected] Date: Wed Sep 16 06:07:37 2009 Log: Push 64-bit crash fix to trunk.
[email protected] Review URL: http://codereview.chromium.org/204038 http://code.google.com/p/v8/source/detail?r=2901 Modified: /trunk/src/version.cc /trunk/src/x64/codegen-x64.cc /trunk/test/mjsunit/array-splice.js ======================================= --- /trunk/src/version.cc Tue Sep 15 05:20:11 2009 +++ /trunk/src/version.cc Wed Sep 16 06:07:37 2009 @@ -35,7 +35,7 @@ #define MAJOR_VERSION 1 #define MINOR_VERSION 3 #define BUILD_NUMBER 11 -#define PATCH_LEVEL 0 +#define PATCH_LEVEL 1 #define CANDIDATE_VERSION false // Define SONAME to have the SCons build the put a specific SONAME into the ======================================= --- /trunk/src/x64/codegen-x64.cc Tue Sep 15 05:20:11 2009 +++ /trunk/src/x64/codegen-x64.cc Wed Sep 16 06:07:37 2009 @@ -6320,7 +6320,7 @@ // Also enter it if the value of the smi is Smi::kMinValue __ testl(rax, Immediate(0x7FFFFFFE)); __ j(zero, &special); - __ neg(rax); + __ negl(rax); __ jmp(&done); __ bind(&special); ======================================= --- /trunk/test/mjsunit/array-splice.js Mon Feb 9 16:49:54 2009 +++ /trunk/test/mjsunit/array-splice.js Wed Sep 16 06:07:37 2009 @@ -309,3 +309,6 @@ assertEquals(1, arr.pop()); assertEquals(0, arr.pop()); Array.prototype[1] = undefined; + +// Test http://code.google.com/p/chromium/issues/detail?id=21860 +Array.prototype.push.apply([], [1].splice(0, -(-1 % 5))); --~--~---------~--~----~------------~-------~--~----~ v8-dev mailing list [email protected] http://groups.google.com/group/v8-dev -~----------~----~----~----~------~----~------~--~---
