Reviewers: danno,
Description:
Merged r13000, r13056, r13061, r13067, r13082, r13083, r13084, r13085 into
3.14
branch.
Ensure CopyElementsImpl is always executed so it fills in holes even if
from_size is 0.
Ensure double arrays are filled with holes when extended from variations of
empty arrays.
Ensure we do not clobber the register holding the elements backing store.
Only fill in holes if storing the number to the double array has succeeded.
CopyPackedSmiToDoubleElements should fill the FixedDoubleArray with holes
MIPS: Ensure double arrays are filled with holes when extended from
variations
of empty arrays.
MIPS: Ensure we do not clobber the register holding the elements backing
store.
MIPS: Only fill in holes if storing the number to the double array has
succeeded.
BUG=162085,v8:2433,167372,v8:2461
[email protected]
Please review this at https://chromiumcodereview.appspot.com/11784017/
SVN Base: https://v8.googlecode.com/svn/branches/3.14
Affected files:
M src/arm/stub-cache-arm.cc
M src/elements.cc
M src/ia32/stub-cache-ia32.cc
M src/mips/stub-cache-mips.cc
M src/objects-inl.h
M src/objects.h
M src/parser.cc
M src/version.cc
M src/x64/stub-cache-x64.cc
M test/mjsunit/array-store-and-grow.js
A + test/mjsunit/regress/regress-2433.js
--
v8-dev mailing list
[email protected]
http://groups.google.com/group/v8-dev
