Reviewers: Mads Ager,
Description:
Merge r7706 from the bleeding_edge to the 3.2 branch.
r7706: Fix missing writebarrier in ArraySplice builtin.
Please review this at http://codereview.chromium.org/6901094/
SVN Base: http://v8.googlecode.com/svn/branches/3.2/
Affected files:
M src/builtins.cc
M src/version.cc
A + test/mjsunit/regress/splice-missing-wb.js
### BEGIN SVN COPY METADATA
#$ cp branches/bleeding_edge/test/mjsunit/regress/splice-missing-wb.js
test/mjsunit/regress/splice-missing-wb.js
### END SVN COPY METADATA
Index: src/builtins.cc
===================================================================
--- src/builtins.cc (revision 7699)
+++ src/builtins.cc (working copy)
@@ -838,8 +838,8 @@
const int delta = actual_delete_count - item_count;
if (actual_start > 0) {
- Object** start = elms->data_start();
- memmove(start + delta, start, actual_start * kPointerSize);
+ AssertNoAllocation no_gc;
+ MoveElements(heap, &no_gc, elms, delta, elms, 0, actual_start);
}
elms = LeftTrimFixedArray(heap, elms, delta);
Index: src/version.cc
===================================================================
--- src/version.cc (revision 7700)
+++ src/version.cc (working copy)
@@ -35,7 +35,7 @@
#define MAJOR_VERSION 3
#define MINOR_VERSION 2
#define BUILD_NUMBER 10
-#define PATCH_LEVEL 4
+#define PATCH_LEVEL 5
// Use 1 for candidates and 0 otherwise.
// (Boolean macro values are not supported by all preprocessors.)
#define IS_CANDIDATE_VERSION 0
Index: test/mjsunit/regress/splice-missing-wb.js
--
v8-dev mailing list
[email protected]
http://groups.google.com/group/v8-dev
