Reviewers: paul.l..., akos.palfi.imgtec, balazs.kilvady,
Description:
MIPS: Fix rare random crashes in keyed store if element transition is
needed.
TEST=mjsunit/sin-cos
BUG=
Please review this at https://codereview.chromium.org/865153002/
Base URL: https://chromium.googlesource.com/v8/v8.git@master
Affected files (+1, -1 lines):
M src/mips/codegen-mips.cc
Index: src/mips/codegen-mips.cc
diff --git a/src/mips/codegen-mips.cc b/src/mips/codegen-mips.cc
index
0e28eed8001a524469d08a9c8dd2aa93eed7dabb..9188f7b2b0374069348f4ee2c909b35d21fa9e40
100644
--- a/src/mips/codegen-mips.cc
+++ b/src/mips/codegen-mips.cc
@@ -750,7 +750,7 @@ void ElementsTransitionGenerator::GenerateSmiToDouble(
OMIT_SMI_CHECK);
// Replace receiver's backing store with newly created FixedDoubleArray.
__ Addu(scratch1, array, Operand(kHeapObjectTag));
- __ sw(scratch1, FieldMemOperand(a2, JSObject::kElementsOffset));
+ __ sw(scratch1, FieldMemOperand(receiver, JSObject::kElementsOffset));
__ RecordWriteField(receiver,
JSObject::kElementsOffset,
scratch1,
--
--
v8-dev mailing list
[email protected]
http://groups.google.com/group/v8-dev
---
You received this message because you are subscribed to the Google Groups "v8-dev" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
For more options, visit https://groups.google.com/d/optout.
