Reviewers: Toon Verwaest,
Description:
Properly handle misses for StoreArrayLengthStub on ia32 and x64
Both failed to generate a miss if the key wasn't "length".
ARM and MIPS were already correct.
BUG=v8:2566
Please review this at https://codereview.chromium.org/12378085/
SVN Base: https://v8.googlecode.com/svn/branches/bleeding_edge
Affected files:
M src/ia32/code-stubs-ia32.cc
M src/x64/code-stubs-x64.cc
A + test/mjsunit/regress/regress-2566.js
Index: src/ia32/code-stubs-ia32.cc
diff --git a/src/ia32/code-stubs-ia32.cc b/src/ia32/code-stubs-ia32.cc
index
b0a32eadcfc85e54a2cdfe20d0cb6269ad0b0d67..daa5623c025a3d86238caaa82129491b1fda746c
100644
--- a/src/ia32/code-stubs-ia32.cc
+++ b/src/ia32/code-stubs-ia32.cc
@@ -3363,7 +3363,7 @@ void StoreArrayLengthStub::Generate(MacroAssembler*
masm) {
Register value = eax;
Register scratch = ebx;
- if (kind() == Code::KEYED_LOAD_IC) {
+ if (kind() == Code::KEYED_STORE_IC) {
__ cmp(ecx, Immediate(masm->isolate()->factory()->length_string()));
__ j(not_equal, &miss);
}
Index: src/x64/code-stubs-x64.cc
diff --git a/src/x64/code-stubs-x64.cc b/src/x64/code-stubs-x64.cc
index
e2ca0718f65f11ff6475c8980c9059714311c640..269cabb97721ab9081a854a3725ea5dc8874b877
100644
--- a/src/x64/code-stubs-x64.cc
+++ b/src/x64/code-stubs-x64.cc
@@ -2481,6 +2481,7 @@ void StoreArrayLengthStub::Generate(MacroAssembler*
masm) {
Register scratch = rbx;
if (kind() == Code::KEYED_STORE_IC) {
__ Cmp(rcx, masm->isolate()->factory()->length_string());
+ __ j(not_equal, &miss);
}
// Check that the receiver isn't a smi.
Index: test/mjsunit/regress/regress-2566.js
diff --git a/test/mjsunit/regress/regress-crbug-173974.js
b/test/mjsunit/regress/regress-2566.js
similarity index 91%
copy from test/mjsunit/regress/regress-crbug-173974.js
copy to test/mjsunit/regress/regress-2566.js
index
905bd6058a0ad0fe2ebe10e4c7dafbe9945cbe3b..582bad979606008d8b6b9ffa080824fd18e58479
100644
--- a/test/mjsunit/regress/regress-crbug-173974.js
+++ b/test/mjsunit/regress/regress-2566.js
@@ -25,12 +25,10 @@
// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
-// Flags: --allow-natives-syntax
-
-function f() {
- var count = "";
- count[0] --;
+function setProp(obj, prop, val) {
+ obj[prop] = val;
}
-f();
-%OptimizeFunctionOnNextCall(f);
-f();
+var obj = [];
+setProp(obj, 'length', 1);
+setProp(obj, 0, 5);
+assertEquals(1, obj.length);
--
--
v8-dev mailing list
[email protected]
http://groups.google.com/group/v8-dev
---
You received this message because you are subscribed to the Google Groups "v8-dev" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
For more options, visit https://groups.google.com/groups/opt_out.
