Merge r3505 and r3509 to trunk.

trunk/src/ia32/codegen-ia32.cc

 // Copyright 2006-2009 the V8 project authors. All rights reserved.
 // Redistribution and use in source and binary forms, with or without
 // modification, are permitted provided that the following conditions are
 // met:
 //
 //     * Redistributions of source code must retain the above copyright
 //       notice, this list of conditions and the following disclaimer.
 //     * Redistributions in binary form must reproduce the above
 //       copyright notice, this list of conditions and the following
 //       disclaimer in the documentation and/or other materials provided
@@ skipping 156 matching lines @@
     frame_->Enter();
 
     // Allocate space for locals and initialize them.
     frame_->AllocateStackSlots();
     // Initialize the function return target after the locals are set
     // up, because it needs the expected frame height from the frame.
     function_return_.set_direction(JumpTarget::BIDIRECTIONAL);
     function_return_is_shadowed_ = false;
 
     // Allocate the local context if needed.
-    int heap_slots = scope_->num_heap_slots();
+    int heap_slots = scope_->num_heap_slots() - Context::MIN_CONTEXT_SLOTS;
     if (heap_slots > 0) {
       Comment cmnt(masm_, "[ allocate local context");
       // Allocate local context.
       // Get outer context and create a new context based on it.
       frame_->PushFunction();
       Result context;
       if (heap_slots <= FastNewContextStub::kMaximumSlots) {
         FastNewContextStub stub(heap_slots);
         context = frame_->CallStub(&stub, 1);
       } else {
@@ skipping 6546 matching lines @@
   __ mov(FieldOperand(eax, HeapObject::kMapOffset), Factory::context_map());
   __ mov(FieldOperand(eax, Array::kLengthOffset), Immediate(length));
 
   // Setup the fixed slots.
   __ xor_(ebx, Operand(ebx));  // Set to NULL.
   __ mov(Operand(eax, Context::SlotOffset(Context::CLOSURE_INDEX)), ecx);
   __ mov(Operand(eax, Context::SlotOffset(Context::FCONTEXT_INDEX)), eax);
   __ mov(Operand(eax, Context::SlotOffset(Context::PREVIOUS_INDEX)), ebx);
   __ mov(Operand(eax, Context::SlotOffset(Context::EXTENSION_INDEX)), ebx);
 
-  // Copy the global object from the surrounding context.
-  __ mov(ebx, Operand(esi, Context::SlotOffset(Context::GLOBAL_INDEX)));
+  // Copy the global object from the surrounding context. We go through the
+  // context in the function (ecx) to match the allocation behavior we have
+  // in the runtime system (see Heap::AllocateFunctionContext).
+  __ mov(ebx, FieldOperand(ecx, JSFunction::kContextOffset));
+  __ mov(ebx, Operand(ebx, Context::SlotOffset(Context::GLOBAL_INDEX)));
   __ mov(Operand(eax, Context::SlotOffset(Context::GLOBAL_INDEX)), ebx);
 
   // Initialize the rest of the slots to undefined.
   __ mov(ebx, Factory::undefined_value());
   for (int i = Context::MIN_CONTEXT_SLOTS; i < length; i++) {
     __ mov(Operand(eax, Context::SlotOffset(i)), ebx);
   }
 
   // Return and remove the on-stack parameter.
   __ mov(esi, Operand(eax));
@@ skipping 2041 matching lines @@
     __ add(Operand(dest), Immediate(2));
   }
   __ sub(Operand(count), Immediate(1));
   __ j(not_zero, &loop);
 }
 
 
 #undef __
 
 } }  // namespace v8::internal