AuroraMiddleware/v8
1
0
Fork 0
Code Issues 2 Pull Requests Releases Wiki Activity

Revert the (wrong) fix of the argument index check asserion.

Browse Source 
R=ishell@chromium.org
BUG=

Review URL: https://codereview.chromium.org/208423017

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@20219 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
This commit is contained in:
jarin@chromium.org 2014-03-24 21:32:19 +00:00
parent 56f2006605
commit b765d3cdb9
2 changed files with 3 additions and 21 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

11
src/x64/lithium-codegen-x64.cc
View File

@ -2910,14 +2910,9 @@ void LCodeGen::DoAccessArgumentsAt(LAccessArgumentsAt* instr) {
instr->index()->IsConstantOperand()) {
int32_t const_index = ToInteger32(LConstantOperand::cast(instr->index()));
int32_t const_length = ToInteger32(LConstantOperand::cast(instr->length()));
if (const_index < const_length) {
StackArgumentsAccessor args(arguments, const_length,
ARGUMENTS_DONT_CONTAIN_RECEIVER);
__ movp(result, args.GetArgumentOperand(const_index));
} else {
// This code should never be executed; just stop here.
__ int3();
}
StackArgumentsAccessor args(arguments, const_length,
ARGUMENTS_DONT_CONTAIN_RECEIVER);
__ movp(result, args.GetArgumentOperand(const_index));
} else {
Register length = ToRegister(instr->length());
// There are two words between the frame pointer and the last argument.

13
test/mjsunit/regress/regress-355486.js
View File

@ -1,13 +0,0 @@
// Copyright 2014 the V8 project authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
// Flags: --allow-natives-syntax
function f() { var v = arguments[0]; }
function g() { f(); }
g();
g();
%OptimizeFunctionOnNextCall(g);
g();