Reviewers: Mads Ager,
Description:
Merge r7706 from the bleeding_edge into 3.1 branch.
r7706: Fix missing writebarrier in ArraySplice builtin.
Please review this at http://codereview.chromium.org/6904088/
SVN Base: http://v8.googlecode.com/svn/branches/3.1/
Affected files:
M src/builtins.cc
M src/version.cc
A + test/mjsunit/regress/splice-missing-wb.js
### BEGIN SVN COPY METADATA
#$ cp branches/bleeding_edge/test/mjsunit/regress/splice-missing-wb.js
test/mjsunit/regress/splice-missing-wb.js
### END SVN COPY METADATA
Index: src/builtins.cc
===================================================================
--- src/builtins.cc (revision 7699)
+++ src/builtins.cc (working copy)
@@ -818,8 +818,8 @@
const int delta = actual_delete_count - item_count;
if (actual_start > 0) {
- Object** start = elms->data_start();
- memmove(start + delta, start, actual_start * kPointerSize);
+ AssertNoAllocation no_gc;
+ MoveElements(heap, &no_gc, elms, delta, elms, 0, actual_start);
}
elms = LeftTrimFixedArray(elms, delta);
Index: src/version.cc
===================================================================
--- src/version.cc (revision 7701)
+++ src/version.cc (working copy)
@@ -35,7 +35,7 @@
#define MAJOR_VERSION 3
#define MINOR_VERSION 1
#define BUILD_NUMBER 8
-#define PATCH_LEVEL 13
+#define PATCH_LEVEL 14
#define CANDIDATE_VERSION false
// Define SONAME to have the SCons build the put a specific SONAME into the
Index: test/mjsunit/regress/splice-missing-wb.js
--
v8-dev mailing list
[email protected]
http://groups.google.com/group/v8-dev
