[v8-dev] Merge r8390 from bleeding edge (fix missing write barrier in arguments IC). (issue7247001)

[fschneider]

Reviewers: Karl Klose,

Description:
Merge r8390 from bleeding edge (fix missing write barrier in arguments IC).
Please review this at http://codereview.chromium.org/7247001/

SVN Base: http://v8.googlecode.com/svn/trunk/

Affected files:
  M     src/arm/ic-arm.cc
  M     src/ia32/ic-ia32.cc
  M     src/version.cc
  M     src/x64/ic-x64.cc
  M     test/mjsunit/arguments-escape.js
  A  +  test/mjsunit/regress/regress-arguments-gc.js


### BEGIN SVN COPY METADATA
#$ cp branches/bleeding_edge/test/mjsunit/regress/regress-arguments-gc.js  
test/mjsunit/regress/regress-arguments-gc.js
### END SVN COPY METADATA
Index: src/arm/ic-arm.cc
===================================================================
--- src/arm/ic-arm.cc   (revision 8390)
+++ src/arm/ic-arm.cc   (working copy)
@@ -996,12 +996,16 @@
   MemOperand mapped_location =
       GenerateMappedArgumentsLookup(masm, r2, r1, r3, r4, r5, &notin,  
&slow);
   __ str(r0, mapped_location);
+  __ add(r6, r3, r5);
+  __ RecordWrite(r3, r6, r9);
   __ Ret();
   __ bind(&notin);
   // The unmapped lookup expects that the parameter map is in r3.
   MemOperand unmapped_location =
       GenerateUnmappedArgumentsLookup(masm, r1, r3, r4, &slow);
   __ str(r0, unmapped_location);
+  __ add(r6, r3, r4);
+  __ RecordWrite(r3, r6, r9);
   __ Ret();
   __ bind(&slow);
   GenerateMiss(masm, false);
Index: src/ia32/ic-ia32.cc
===================================================================
--- src/ia32/ic-ia32.cc (revision 8390)
+++ src/ia32/ic-ia32.cc (working copy)
@@ -801,12 +801,18 @@
   Operand mapped_location =
       GenerateMappedArgumentsLookup(masm, edx, ecx, ebx, edi, &notin,  
&slow);
   __ mov(mapped_location, eax);
+  __ lea(ecx, mapped_location);
+  __ mov(edx, eax);
+  __ RecordWrite(ebx, ecx, edx);
   __ Ret();
   __ bind(&notin);
   // The unmapped lookup expects that the parameter map is in ebx.
   Operand unmapped_location =
       GenerateUnmappedArgumentsLookup(masm, ecx, ebx, edi, &slow);
   __ mov(unmapped_location, eax);
+  __ lea(edi, unmapped_location);
+  __ mov(edx, eax);
+  __ RecordWrite(ebx, edi, edx);
   __ Ret();
   __ bind(&slow);
   GenerateMiss(masm, false);
Index: src/version.cc
===================================================================
--- src/version.cc      (revision 8390)
+++ src/version.cc      (working copy)
@@ -35,7 +35,7 @@
 #define MAJOR_VERSION     3
 #define MINOR_VERSION     4
 #define BUILD_NUMBER      6
-#define PATCH_LEVEL       0
+#define PATCH_LEVEL       1
 // Use 1 for candidates and 0 otherwise.
 // (Boolean macro values are not supported by all preprocessors.)
 #define IS_CANDIDATE_VERSION 0
Index: src/x64/ic-x64.cc
===================================================================
--- src/x64/ic-x64.cc   (revision 8390)
+++ src/x64/ic-x64.cc   (working copy)
@@ -1308,12 +1308,18 @@
   Operand mapped_location = GenerateMappedArgumentsLookup(
       masm, rdx, rcx, rbx, rdi, r8, &notin, &slow);
   __ movq(mapped_location, rax);
+  __ lea(r9, mapped_location);
+  __ movq(r8, rax);
+  __ RecordWrite(rbx, r9, r8);
   __ Ret();
   __ bind(&notin);
   // The unmapped lookup expects that the parameter map is in rbx.
   Operand unmapped_location =
       GenerateUnmappedArgumentsLookup(masm, rcx, rbx, rdi, &slow);
   __ movq(unmapped_location, rax);
+  __ lea(r9, unmapped_location);
+  __ movq(r8, rax);
+  __ RecordWrite(rbx, r9, r8);
   __ Ret();
   __ bind(&slow);
   GenerateMiss(masm, false);
Index: test/mjsunit/arguments-escape.js
===================================================================
--- test/mjsunit/arguments-escape.js    (revision 8390)
+++ test/mjsunit/arguments-escape.js    (working copy)
@@ -40,3 +40,20 @@
 baz(4);
 baz(5);
 baz(6);
+
+// Test writing a non-smi.
+function foo2(x) {
+  var a = arguments;
+  function bar2(i) {
+    assertEquals(i, ++a[0]);
+    assertEquals(i, x);
+  };
+  bar2(1.5);
+  bar2(2.5);
+  bar2(3.5);
+  return bar2;
+}
+var baz2 = foo2(0.5);
+baz2(4.5);
+baz2(5.5);
+baz2(6.5);
Index: test/mjsunit/regress/regress-arguments-gc.js


--
v8-dev mailing list
v8-dev@googlegroups.com
http://groups.google.com/group/v8-dev