Fix FixedDoubleArray crashes in chromebot

Fix FixedDoubleArray crashes in chromebot

R=ricow@chromium.org
BUG=non
TEST=running urls from reliability bots

Committed: http://code.google.com/p/v8/source/detail?r=8748

[danno, 2011-07-26 16:27:51]

Please review.

[Rico, 2011-07-27 08:05:51]

LGTM, consider adding a regression test for this

http://codereview.chromium.org/7497010/diff/2001/src/heap.cc
File src/heap.cc (right):

http://codereview.chromium.org/7497010/diff/2001/src/heap.cc#newcode3400
src/heap.cc:3400: maybe_elem =
Fits on one line

http://codereview.chromium.org/7497010/diff/2001/src/heap.cc#newcode3770
src/heap.cc:3770: { MaybeObject* maybe_obj = AllocateRawFixedDoubleArray(len,
Fits on one line

http://codereview.chromium.org/7497010/diff/2001/src/heap.cc#newcode3776
src/heap.cc:3776: CopyBlock(dst->address() + kPointerSize,
Would it not be more correct to use FixedDoubleArray::kLengthOffset or
HeapObject::kHeaderSize, instead of just adding kPointerSize here

[danno, 2011-07-27 11:05:54]

Feedback addressed, please take another quick look, since there were a few minor
additional tweaks to get rid of all the problems. 

I'll see if there is an easy way to add a regression test in a separate CL.

http://codereview.chromium.org/7497010/diff/2001/src/heap.cc
File src/heap.cc (right):

http://codereview.chromium.org/7497010/diff/2001/src/heap.cc#newcode3400
src/heap.cc:3400: maybe_elem =
On 2011/07/27 08:05:51, Rico wrote:
> Fits on one line

Done.

http://codereview.chromium.org/7497010/diff/2001/src/heap.cc#newcode3770
src/heap.cc:3770: { MaybeObject* maybe_obj = AllocateRawFixedDoubleArray(len,
On 2011/07/27 08:05:51, Rico wrote:
> Fits on one line

Done.

http://codereview.chromium.org/7497010/diff/2001/src/heap.cc#newcode3776
src/heap.cc:3776: CopyBlock(dst->address() + kPointerSize,
On 2011/07/27 08:05:51, Rico wrote:
> Would it not be more correct to use FixedDoubleArray::kLengthOffset or
> HeapObject::kHeaderSize, instead of just adding kPointerSize here

Done.

[Rico, 2011-07-27 11:31:01]

LGTM

http://codereview.chromium.org/7497010/diff/5001/src/runtime.cc
File src/runtime.cc (right):

http://codereview.chromium.org/7497010/diff/5001/src/runtime.cc#newcode223
src/runtime.cc:223: case JSObject::EXTERNAL_PIXEL_ELEMENTS:
default: last?