Fixed bug in pixel array inline cache on x64. The value was not...

Fixed bug in pixel array inline cache on x64.  The value was not
zero-extended as it should be.  Therefore, the index into the pixel
array could influence the value on reads.

BUG=http://code.google.com/p/chromium/issues/detail?id=26337

Committed: http://code.google.com/p/v8/source/detail?r=3328

[Søren Thygesen Gjesse, 2009-11-18 11:30:16]

LGTM

http://codereview.chromium.org/399067/diff/1/2
File test/cctest/test-api.cc (right):

http://codereview.chromium.org/399067/diff/1/2#newcode7773
Line 7773: "for (var j = 0; j < 8; j++) { i = pixels[256]; }"
How about using i+= pixels[256] and checking for i == 8 * 255?

[Mads Ager (chromium), 2009-11-18 11:35:55]

http://codereview.chromium.org/399067/diff/1/2
File test/cctest/test-api.cc (right):

http://codereview.chromium.org/399067/diff/1/2#newcode7773
Line 7773: "for (var j = 0; j < 8; j++) { i = pixels[256]; }"
On 2009/11/18 11:30:16, Søren Gjesse wrote:
> How about using i+= pixels[256] and checking for i == 8 * 255?

The 8 is only there to make sure that we hit the IC case.  All other tests here
use 8, so I went for that as well.