AuroraMiddleware/v8
1
0
Fork 0
Code Issues 2 Pull Requests Releases Wiki Activity

Fix crashes on x64 with smi-only arrays active.

Browse Source 
Review URL: https://chromiumcodereview.appspot.com/9384002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10672 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
This commit is contained in:
yangguo@chromium.org 2012-02-10 12:28:25 +00:00
parent 581b7e6eb2
commit e74b57317b
1 changed files with 3 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
src/x64/stub-cache-x64.cc
View File

@ -1384,19 +1384,19 @@ Handle<Code> CallStubCompiler::CompileArrayPushCall(
__ CheckFastSmiOnlyElements(rbx, &call_builtin);
// rdx: receiver
// rbx: map
__ movq(r9, rdi); // Backup rdi as it is going to be trashed.
__ LoadTransitionedArrayMapConditional(FAST_SMI_ONLY_ELEMENTS,
FAST_ELEMENTS,
rbx,
r10,
rdi,
&call_builtin);
ElementsTransitionGenerator::GenerateSmiOnlyToObject(masm());
__ movq(rdi, r9);
__ bind(&fast_object);
} else {
__ CheckFastObjectElements(rbx, &call_builtin);
}
__ CheckFastObjectElements(rbx, &call_builtin);
// Save new length.
__ Integer32ToSmiField(FieldOperand(rdx, JSArray::kLengthOffset), rax);