Reviewers: ulan, Jakob,
Description:
ARM64: Fix stack manipulation.
Builtins::Generate_StringConstructCode was claiming stack space instead of
giving it back.
BUG=425585
Please review this at https://codereview.chromium.org/672623003/
Base URL: https://v8.googlecode.com/svn/branches/bleeding_edge
Affected files (+16, -15 lines):
M src/arm64/builtins-arm64.cc
A + test/mjsunit/regress/regress-crbug-425585.js
Index: src/arm64/builtins-arm64.cc
diff --git a/src/arm64/builtins-arm64.cc b/src/arm64/builtins-arm64.cc
index
e9ad8f165d7b694399e1181effc4a0a5602e0e15..74535ba61598d93cfc88e252ecde53e68b23d86e
100644
--- a/src/arm64/builtins-arm64.cc
+++ b/src/arm64/builtins-arm64.cc
@@ -156,7 +156,7 @@ void
Builtins::Generate_StringConstructCode(MacroAssembler* masm) {
__ Cbz(argc, &no_arguments);
// First args = sp[(argc - 1) * 8].
__ Sub(argc, argc, 1);
- __ Claim(argc, kXRegSize);
+ __ Drop(argc, kXRegSize);
// jssp now point to args[0], load and drop args[0] + receiver.
Register arg = argc;
__ Ldr(arg, MemOperand(jssp, 2 * kPointerSize, PostIndex));
Index: test/mjsunit/regress/regress-crbug-425585.js
diff --git a/test/mjsunit/regress/comparison-in-effect-context-deopt.js
b/test/mjsunit/regress/regress-crbug-425585.js
similarity index 76%
copy from test/mjsunit/regress/comparison-in-effect-context-deopt.js
copy to test/mjsunit/regress/regress-crbug-425585.js
index
b28dff73a745dfc7445a6c093380c56f51b3fb76..c27febba790148008834ea1c563f7fae11b042ef
100644
--- a/test/mjsunit/regress/comparison-in-effect-context-deopt.js
+++ b/test/mjsunit/regress/regress-crbug-425585.js
@@ -25,23 +25,24 @@
// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
-// Flags: --allow-natives-syntax
-function lazyDeopt() {
- %DeoptimizeFunction(test);
- return "deopt";
-}
-
-var x = { toString : lazyDeopt };
+var correct_result = "This is the correct result.";
-function g(x) {
- return "result";
+function foo(recursion_depth) {
+ if (recursion_depth > 0) return foo(recursion_depth - 1);
+ return new String(correct_result, 1, 2, 3, 4, 5, 6);
}
-function test(x) {
- return g(void(x == ""));
+// Roll our own non-strict assertEquals replacement.
+function test(i) {
+ var actual = foo(i);
+ if (correct_result != actual) {
+ var msg = "Expected \"" + correct_result + "\", found " + actual;
+ throw new MjsUnitAssertionError(msg);
+ }
}
-test(x);
-%OptimizeFunctionOnNextCall(test);
-assertEquals("result", test(x));
+test(1);
+test(1);
+test(10);
+test(100);
--
--
v8-dev mailing list
[email protected]
http://groups.google.com/group/v8-dev
---
You received this message because you are subscribed to the Google Groups "v8-dev" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
For more options, visit https://groups.google.com/d/optout.
