Reviewers: Jakob,
Description:
Merged r14481 into 3.17 branch.
Fix beyond-heap load on x64 Crankshafted StringCharFromCode
BUG=chromium:235311
[email protected]
Please review this at https://codereview.chromium.org/14959008/
SVN Base: https://v8.googlecode.com/svn/branches/3.17
Affected files:
M src/version.cc
M src/x64/lithium-codegen-x64.cc
A + test/mjsunit/regress/regress-235311.js
Index: src/version.cc
diff --git a/src/version.cc b/src/version.cc
index
766772de3998c4e149f5bc9596840e2a97474ba5..d51aa8829e4e9196ab60a7cba15b29f03c1a8b43
100644
--- a/src/version.cc
+++ b/src/version.cc
@@ -35,7 +35,7 @@
#define MAJOR_VERSION 3
#define MINOR_VERSION 17
#define BUILD_NUMBER 6
-#define PATCH_LEVEL 12
+#define PATCH_LEVEL 13
// Use 1 for candidates and 0 otherwise.
// (Boolean macro values are not supported by all preprocessors.)
#define IS_CANDIDATE_VERSION 0
Index: src/x64/lithium-codegen-x64.cc
diff --git a/src/x64/lithium-codegen-x64.cc b/src/x64/lithium-codegen-x64.cc
index
3722f1465939fa78d5933eeb9582871750031965..b55b1fcf579afb7a16912a418b690eb9c4c0bf68
100644
--- a/src/x64/lithium-codegen-x64.cc
+++ b/src/x64/lithium-codegen-x64.cc
@@ -4372,6 +4372,7 @@ void
LCodeGen::DoStringCharFromCode(LStringCharFromCode* instr) {
__ cmpl(char_code, Immediate(String::kMaxOneByteCharCode));
__ j(above, deferred->entry());
+ __ movsxlq(char_code, char_code);
__ LoadRoot(result, Heap::kSingleCharacterStringCacheRootIndex);
__ movq(result, FieldOperand(result,
char_code, times_pointer_size,
Index: test/mjsunit/regress/regress-235311.js
diff --git a/test/mjsunit/regress/regress-crbug-172345.js
b/test/mjsunit/regress/regress-235311.js
similarity index 91%
copy from test/mjsunit/regress/regress-crbug-172345.js
copy to test/mjsunit/regress/regress-235311.js
index
711501caa791f2974635ac4dd894568a2e3fc982..300714718f75e3ab084687af21aa1bf145e16678
100644
--- a/test/mjsunit/regress/regress-crbug-172345.js
+++ b/test/mjsunit/regress/regress-235311.js
@@ -25,10 +25,8 @@
// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
-function f(a,i) {
- return a[i];
+var new_space_string = "";
+for (var i = 0; i < 12800; ++i) {
+ new_space_string +=
+ String.fromCharCode(Math.random() * 26 + (4294967295) | 0);
}
-
-f([1,2,3], "length");
-f([1,2,3], "length");
-f([1,2,3], 2);
--
--
v8-dev mailing list
[email protected]
http://groups.google.com/group/v8-dev
---
You received this message because you are subscribed to the Google Groups "v8-dev" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
For more options, visit https://groups.google.com/groups/opt_out.
