Revision: 4183 Author: [email protected] Date: Thu Mar 18 07:38:11 2010 Log: Merge r4182 to trunk.
Fixes a crash in the code generator. Review URL: http://codereview.chromium.org/1098002 http://code.google.com/p/v8/source/detail?r=4183 Modified: /trunk/src/ia32/codegen-ia32.cc /trunk/src/version.cc /trunk/test/mjsunit/compiler/loopcount.js ======================================= --- /trunk/src/ia32/codegen-ia32.cc Thu Mar 18 03:06:01 2010 +++ /trunk/src/ia32/codegen-ia32.cc Thu Mar 18 07:38:11 2010 @@ -3765,7 +3765,7 @@ // The update expression resets the type of the loop variable. So we // set it to smi before compiling the test expression. - if (node->is_fast_smi_loop()) { + if (node->is_fast_smi_loop() && has_valid_frame()) { // Set number type of the loop variable to smi. Slot* slot = node->loop_variable()->slot(); ASSERT(slot->type() == Slot::LOCAL); ======================================= --- /trunk/src/version.cc Thu Mar 18 03:06:01 2010 +++ /trunk/src/version.cc Thu Mar 18 07:38:11 2010 @@ -35,7 +35,7 @@ #define MAJOR_VERSION 2 #define MINOR_VERSION 1 #define BUILD_NUMBER 6 -#define PATCH_LEVEL 1 +#define PATCH_LEVEL 2 #define CANDIDATE_VERSION false // Define SONAME to have the SCons build the put a specific SONAME into the ======================================= --- /trunk/test/mjsunit/compiler/loopcount.js Thu Mar 18 03:06:01 2010 +++ /trunk/test/mjsunit/compiler/loopcount.js Thu Mar 18 07:38:11 2010 @@ -54,5 +54,33 @@ } assertEquals(-0x40000001, f5()); + function f6() { var x = 0x3fffffff; x++; return x+1; } assertEquals(0x40000001, f6()); + + +function f7() { + var i; + for (i = 0x3ffffffd; i <= 0x3ffffffe; i++) {} + i++; i = i + 1; + return i; +} +assertEquals(0x40000001, f7()); + + +function f8() { + var i; + for (i = 0x3ffffffd; i <= 0x3fffffff; i++) {} + i++; i++; + return i; +} +assertEquals(0x40000002, f8()); + + +function f9() { + var i; + for (i = 0; i < 42; i++) { + return 42; + } +} +assertEquals(42, f9()); -- v8-dev mailing list [email protected] http://groups.google.com/group/v8-dev
