Use a large enough variable in CompilationCache::LookupScript to avoid overfl...

src/compilation-cache.cc

 // Copyright 2008 the V8 project authors. All rights reserved.
 // Redistribution and use in source and binary forms, with or without
 // modification, are permitted provided that the following conditions are
 // met:
 //
 //     * Redistributions of source code must retain the above copyright
 //       notice, this list of conditions and the following disclaimer.
 //     * Redistributions in binary form must reproduce the above
 //       copyright notice, this list of conditions and the following
 //       disclaimer in the documentation and/or other materials provided
@@ skipping 120 matching lines @@
 
 // TODO(245): Need to allow identical code from different contexts to
 // be cached in the same script generation. Currently the first use
 // will be cached, but subsequent code from different source / line
 // won't.
 Handle<JSFunction> CompilationCache::LookupScript(Handle<String> source,
                                                   Handle<Object> name,
                                                   int line_offset,
                                                   int column_offset) {
   Object* result = NULL;
-  Entry generation = SCRIPT;  // First generation.
+  // Using int below so value range propagation in gcc 4.3+ won't assume
+  // |generation| can only go up to LAST_ENTRY when in fact it can go
+  // up to SCRIPT + NUMBER_OF_SCRIPT_GENERATIONS.
+  int generation = static_cast<int>(SCRIPT);  // First generation.
 
   // Probe the script generation tables. Make sure not to leak handles
   // into the caller's handle scope.
   { HandleScope scope;
     while (generation < SCRIPT + NUMBER_OF_SCRIPT_GENERATIONS) {
-      Handle<CompilationCacheTable> table = GetTable(generation);
+      Handle<CompilationCacheTable> table =
+          GetTable(static_cast<Entry>(generation));
       Handle<Object> probe(table->Lookup(*source));
       if (probe->IsJSFunction()) {
         Handle<JSFunction> boilerplate = Handle<JSFunction>::cast(probe);
         // Break when we've found a suitable boilerplate function that
         // matches the origin.
         if (HasOrigin(boilerplate, name, line_offset, column_offset)) {
           result = *boilerplate;
           break;
         }
       }
       // Go to the next generation.
-      generation = static_cast<Entry>(generation + 1);
+      generation++;
     }
   }
 
   // Once outside the menacles of the handle scope, we need to recheck
   // to see if we actually found a cached script. If so, we return a
   // handle created in the caller's handle scope.
   if (result != NULL) {
     Handle<JSFunction> boilerplate(JSFunction::cast(result));
     ASSERT(HasOrigin(boilerplate, name, line_offset, column_offset));
     // If the script was found in a later generation, we promote it to
@@ skipping 81 matching lines @@
   for (int i = NUMBER_OF_TABLE_ENTRIES - 1; i > SCRIPT; i--) {
     tables[i] = tables[i - 1];
   }
   for (int j = 0; j <= LAST_ENTRY; j++) {
     tables[j] = Heap::undefined_value();
   }
 }
 
 
 } }  // namespace v8::internal