Fix possible crash in FixedDoubleArray::Initialize()

src/objects-inl.h

 // Copyright 2011 the V8 project authors. All rights reserved.
 // Redistribution and use in source and binary forms, with or without
 // modification, are permitted provided that the following conditions are
 // met:
 //
 //     * Redistributions of source code must retain the above copyright
 //       notice, this list of conditions and the following disclaimer.
 //     * Redistributions in binary form must reproduce the above
 //       copyright notice, this list of conditions and the following
 //       disclaimer in the documentation and/or other materials provided
@@ skipping 1731 matching lines @@
 
 bool FixedDoubleArray::is_the_hole(int index) {
   int offset = kHeaderSize + index * kDoubleSize;
   return is_the_hole_nan(READ_DOUBLE_FIELD(this, offset));
 }
 
 
 void FixedDoubleArray::Initialize(FixedDoubleArray* from) {
   int old_length = from->length();
   ASSERT(old_length < length());
-  OS::MemCopy(FIELD_ADDR(this, kHeaderSize),
-              FIELD_ADDR(from, kHeaderSize),
-              old_length * kDoubleSize);
+  if (old_length * kDoubleSize >= OS::kMinComplexMemCopy) {
+    OS::MemCopy(FIELD_ADDR(this, kHeaderSize),
+                FIELD_ADDR(from, kHeaderSize),
+                old_length * kDoubleSize);
+  } else {
+    int offset = kHeaderSize;
+    for (int i = 0; i < old_length; ++i) {
+      WRITE_DOUBLE_FIELD(this, offset, READ_DOUBLE_FIELD(from, offset));
+      offset += kDoubleSize;
+    }
+  }
   int offset = kHeaderSize + old_length * kDoubleSize;
   for (int current = from->length(); current < length(); ++current) {
     WRITE_DOUBLE_FIELD(this, offset, hole_nan_as_double());

[danno, 2011/09/06 13:22:13]

just do set(current, from->get(current)) and don't track offset.

[Jakob Kummerow, 2011/09/06 13:31:03]

Done.

     offset += kDoubleSize;
   }
 }
 
 
 void FixedDoubleArray::Initialize(FixedArray* from) {
   int old_length = from->length();
   ASSERT(old_length < length());
   for (int i = 0; i < old_length; i++) {
     Object* hole_or_object = from->get(i);
@@ skipping 2911 matching lines @@
 #undef WRITE_INT_FIELD
 #undef READ_SHORT_FIELD
 #undef WRITE_SHORT_FIELD
 #undef READ_BYTE_FIELD
 #undef WRITE_BYTE_FIELD
 
 
 } }  // namespace v8::internal
 
 #endif  // V8_OBJECTS_INL_H_