Add array bound checks to code generated for SwapElements. This fixes a bug t...

src/arm/codegen-arm.cc

Index: src/arm/codegen-arm.cc
===================================================================
--- src/arm/codegen-arm.cc	(revision 6006)
+++ src/arm/codegen-arm.cc	(working copy)
@@ -5592,6 +5592,13 @@
   __ tst(tmp2, Operand(kSmiTagMask));
   deferred->Branch(nz);
 
+  // Check that both indices are valid.
+  __ ldr(tmp2, FieldMemOperand(object, JSArray::kLengthOffset));
+  __ cmp(tmp2, index1);
+  deferred->Branch(le);
+  __ cmp(tmp2, index2);

[Lasse Reichstein, 2010/12/15 08:34:55]

You might consider making the second compare conditional and only having one
branch. I.e.:
 __ cmp(tmp2, index1);
 __ cmp(tmp2, index2, gt);
 deferred->Branch(le);
I doubt it's faster, but it's a little smaller.

[Karl Klose, 2010/12/15 09:11:45]

Done.

+  deferred->Branch(le);
+
   // Bring the offsets into the fixed array in tmp1 into index1 and
   // index2.
   __ mov(tmp2, Operand(FixedArray::kHeaderSize - kHeapObjectTag));