diff --git a/src/ia32/codegen-ia32.cc b/src/ia32/codegen-ia32.cc index 20f513884e..2190531b43 100644 --- a/src/ia32/codegen-ia32.cc +++ b/src/ia32/codegen-ia32.cc @@ -704,6 +704,7 @@ void ElementsTransitionGenerator::GenerateDoubleToObject( __ cmp(edi, Immediate(masm->isolate()->factory()->empty_fixed_array())); __ j(equal, &only_change_map); + __ push(esi); __ push(eax); __ push(edx); __ push(ebx); @@ -753,10 +754,10 @@ void ElementsTransitionGenerator::GenerateDoubleToObject( // Call into runtime if GC is required. __ bind(&gc_required); - __ mov(esi, Operand(ebp, StandardFrameConstants::kContextOffset)); __ pop(ebx); __ pop(edx); __ pop(eax); + __ pop(esi); __ jmp(fail); // Box doubles into heap numbers. @@ -818,7 +819,7 @@ void ElementsTransitionGenerator::GenerateDoubleToObject( // Restore registers. __ pop(eax); - __ mov(esi, Operand(ebp, StandardFrameConstants::kContextOffset)); + __ pop(esi); __ bind(&success); } diff --git a/src/x64/codegen-x64.cc b/src/x64/codegen-x64.cc index 81c1a69aa8..33e987e248 100644 --- a/src/x64/codegen-x64.cc +++ b/src/x64/codegen-x64.cc @@ -288,6 +288,7 @@ void ElementsTransitionGenerator::GenerateDoubleToObject( __ CompareRoot(r8, Heap::kEmptyFixedArrayRootIndex); __ j(equal, &only_change_map); + __ Push(rsi); __ Push(rax); __ movp(r8, FieldOperand(rdx, JSObject::kElementsOffset)); @@ -326,7 +327,7 @@ void ElementsTransitionGenerator::GenerateDoubleToObject( // Call into runtime if GC is required. __ bind(&gc_required); __ Pop(rax); - __ movp(rsi, Operand(rbp, StandardFrameConstants::kContextOffset)); + __ Pop(rsi); __ jmp(fail); // Box doubles into heap numbers. @@ -380,7 +381,7 @@ void ElementsTransitionGenerator::GenerateDoubleToObject( EMIT_REMEMBERED_SET, OMIT_SMI_CHECK); __ Pop(rax); - __ movp(rsi, Operand(rbp, StandardFrameConstants::kContextOffset)); + __ Pop(rsi); __ bind(&only_change_map); // Set transitioned map. diff --git a/test/mjsunit/ignition/regress-597565-double-to-object-transition.js b/test/mjsunit/ignition/regress-597565-double-to-object-transition.js new file mode 100644 index 0000000000..7bf8e83d1e --- /dev/null +++ b/test/mjsunit/ignition/regress-597565-double-to-object-transition.js @@ -0,0 +1,18 @@ +// Copyright 2016 the V8 project authors. All rights reserved. +// Use of this source code is governed by a BSD-style license that can be +// found in the LICENSE file. + +// Flags: --no-inline-new + +function __f_2(b, value) { + b[1] = value; +} +function __f_9() { + var arr = [1.5, 0, 0]; + // Call with a double, so the expected element type is double. + __f_2(1.5); + // Call with an object, which triggers transition from FAST_double + // to Object for the elements type. + __f_2(arr); +} +__f_9();