Revision: 20218
Author: ja...@chromium.org
Date: Mon Mar 24 20:51:36 2014 UTC
Log: Fix to get around an assertion that triggers when generating code
that happens to be dead because the assertion is checked a bit earlier at
runtime.
R=ish...@chromium.org
BUG=355486
LOG=N
Review URL: https://codereview.chromium.org/201573011
http://code.google.com/p/v8/source/detail?r=20218
Added:
/branches/bleeding_edge/test/mjsunit/regress/regress-355486.js
Modified:
/branches/bleeding_edge/src/x64/lithium-codegen-x64.cc
=======================================
--- /dev/null
+++ /branches/bleeding_edge/test/mjsunit/regress/regress-355486.js Mon Mar
24 20:51:36 2014 UTC
@@ -0,0 +1,13 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function f() { var v = arguments[0]; }
+function g() { f(); }
+
+g();
+g();
+%OptimizeFunctionOnNextCall(g);
+g();
=======================================
--- /branches/bleeding_edge/src/x64/lithium-codegen-x64.cc Mon Mar 24
16:25:48 2014 UTC
+++ /branches/bleeding_edge/src/x64/lithium-codegen-x64.cc Mon Mar 24
20:51:36 2014 UTC
@@ -2910,9 +2910,14 @@
instr->index()->IsConstantOperand()) {
int32_t const_index =
ToInteger32(LConstantOperand::cast(instr->index()));
int32_t const_length =
ToInteger32(LConstantOperand::cast(instr->length()));
- StackArgumentsAccessor args(arguments, const_length,
- ARGUMENTS_DONT_CONTAIN_RECEIVER);
- __ movp(result, args.GetArgumentOperand(const_index));
+ if (const_index < const_length) {
+ StackArgumentsAccessor args(arguments, const_length,
+ ARGUMENTS_DONT_CONTAIN_RECEIVER);
+ __ movp(result, args.GetArgumentOperand(const_index));
+ } else {
+ // This code should never be executed; just stop here.
+ __ int3();
+ }
} else {
Register length = ToRegister(instr->length());
// There are two words between the frame pointer and the last argument.
--
--
v8-dev mailing list
v8-dev@googlegroups.com
http://groups.google.com/group/v8-dev
---
You received this message because you are subscribed to the Google Groups "v8-dev" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to v8-dev+unsubscr...@googlegroups.com.
For more options, visit https://groups.google.com/d/optout.
