Reviewers: danno,
Description:
Merge fixes for reliability bot crashes to trunk.
Please review this at http://codereview.chromium.org/7051038/
SVN Base: http://v8.googlecode.com/svn/trunk/
Affected files:
M src/arm/stub-cache-arm.cc
M src/ia32/macro-assembler-ia32.cc
M src/version.cc
M test/mjsunit/external-array.js
A + test/mjsunit/fast-element-smi-check.js
### BEGIN SVN COPY METADATA
#$ cp branches/bleeding_edge/test/mjsunit/fast-element-smi-check.js
test/mjsunit/fast-element-smi-check.js
### END SVN COPY METADATA
Index: src/arm/stub-cache-arm.cc
===================================================================
--- src/arm/stub-cache-arm.cc (revision 7972)
+++ src/arm/stub-cache-arm.cc (working copy)
@@ -3428,7 +3428,7 @@
r3,
Handle<Map>(receiver->map()),
Handle<Code>(stub),
- DONT_DO_SMI_CHECK);
+ DO_SMI_CHECK);
Handle<Code> ic = isolate()->builtins()->KeyedStoreIC_Miss();
__ Jump(ic, RelocInfo::CODE_TARGET);
Index: src/ia32/macro-assembler-ia32.cc
===================================================================
--- src/ia32/macro-assembler-ia32.cc (revision 7972)
+++ src/ia32/macro-assembler-ia32.cc (working copy)
@@ -291,7 +291,7 @@
Handle<Code> success,
SmiCheckType smi_check_type) {
Label fail;
- if (smi_check_type == DONT_DO_SMI_CHECK) {
+ if (smi_check_type == DO_SMI_CHECK) {
JumpIfSmi(obj, &fail);
}
cmp(FieldOperand(obj, HeapObject::kMapOffset), Immediate(map));
Index: src/version.cc
===================================================================
--- src/version.cc (revision 7982)
+++ src/version.cc (working copy)
@@ -35,7 +35,7 @@
#define MAJOR_VERSION 3
#define MINOR_VERSION 3
#define BUILD_NUMBER 9
-#define PATCH_LEVEL 2
+#define PATCH_LEVEL 3
// Use 1 for candidates and 0 otherwise.
// (Boolean macro values are not supported by all preprocessors.)
#define IS_CANDIDATE_VERSION 0
Index: test/mjsunit/external-array.js
===================================================================
--- test/mjsunit/external-array.js (revision 7970)
+++ test/mjsunit/external-array.js (working copy)
@@ -193,4 +193,22 @@
a.length = 2;
assertEquals(2, a.length);
}
+
+ function array_load_set_smi_check(a) {
+ return a[0] = a[0] = 1;
+ }
+
+ array_load_set_smi_check(a);
+ array_load_set_smi_check(0);
+
+ function array_load_set_smi_check2(a) {
+ return a[0] = a[0] = 1;
+ }
+
+ array_load_set_smi_check2(a);
+ %OptimizeFunctionOnNextCall(array_load_set_smi_check2);
+ array_load_set_smi_check2(a);
+ array_load_set_smi_check2(0);
+ %DeoptimizeFunction(array_load_set_smi_check2);
+ gc(); // Makes V8 forget about type information for
array_load_set_smi_check.
}
Index: test/mjsunit/fast-element-smi-check.js
--
v8-dev mailing list
[email protected]
http://groups.google.com/group/v8-dev
