Reviewers: Søren Gjesse,
Description:
Merge r8028 to the 3.1 branch.
Fix a bug in a corner case of deoptimization on x64. The bug was triggered
by deoptimizing to immediately after a duplicated property name in an object
literal.
[email protected]
Please review this at http://codereview.chromium.org/7064025/
SVN Base: https://v8.googlecode.com/svn/branches/3.1
Affected files:
M src/version.cc
M src/x64/full-codegen-x64.cc
Index: src/version.cc
diff --git a/src/version.cc b/src/version.cc
index
385fb8ad8a7232b27ab303be02b808df84e2b528..a899aac26c8e3d1180f880323508fa0eef59d67f
100644
--- a/src/version.cc
+++ b/src/version.cc
@@ -35,7 +35,7 @@
#define MAJOR_VERSION 3
#define MINOR_VERSION 1
#define BUILD_NUMBER 8
-#define PATCH_LEVEL 21
+#define PATCH_LEVEL 22
#define CANDIDATE_VERSION false
// Define SONAME to have the SCons build the put a specific SONAME into the
Index: src/x64/full-codegen-x64.cc
diff --git a/src/x64/full-codegen-x64.cc b/src/x64/full-codegen-x64.cc
index
0ad6ec23769457510bef4a4db068d10f411e07d7..60b77b5bfe52dd30ab7569228a32020d334a7e68
100644
--- a/src/x64/full-codegen-x64.cc
+++ b/src/x64/full-codegen-x64.cc
@@ -1383,13 +1383,17 @@ void
FullCodeGenerator::VisitObjectLiteral(ObjectLiteral* expr) {
// Fall through.
case ObjectLiteral::Property::COMPUTED:
if (key->handle()->IsSymbol()) {
- VisitForAccumulatorValue(value);
- __ Move(rcx, key->handle());
- __ movq(rdx, Operand(rsp, 0));
if (property->emit_store()) {
- Handle<Code>
ic(Builtins::builtin(Builtins::StoreIC_Initialize));
+ VisitForAccumulatorValue(value);
+ __ Move(rcx, key->handle());
+ __ movq(rdx, Operand(rsp, 0));
+ Handle<Code> ic(Builtins::builtin(
+ is_strict() ? Builtins::StoreIC_Initialize_Strict
+ : Builtins::StoreIC_Initialize));
EmitCallIC(ic, RelocInfo::CODE_TARGET);
PrepareForBailoutForId(key->id(), NO_REGISTERS);
+ } else {
+ VisitForEffect(value);
}
break;
}
--
v8-dev mailing list
[email protected]
http://groups.google.com/group/v8-dev
