Allow new-space JSFunction objects as constant-function properties.

src/arm/macro-assembler-arm.cc

Index: src/arm/macro-assembler-arm.cc
===================================================================
--- src/arm/macro-assembler-arm.cc	(revision 9574)
+++ src/arm/macro-assembler-arm.cc	(working copy)
@@ -407,6 +407,19 @@
 }
 
 
+void MacroAssembler::LoadHeapObject(Register result,
+                                    Handle<HeapObject> object) {
+  if (isolate()->heap()->InNewSpace(*object)) {
+    Handle<JSGlobalPropertyCell> cell =
+        isolate()->factory()->NewJSGlobalPropertyCell(object);
+    mov(result, Operand(cell));
+    ldr(result, FieldMemOperand(result, JSGlobalPropertyCell::kValueOffset));
+  } else {
+    mov(result, Operand(object));
+  }
+}
+
+
 void MacroAssembler::InNewSpace(Register object,
                                 Register scratch,
                                 Condition cond,
@@ -1104,7 +1117,7 @@
   ASSERT(function->is_compiled());
 
   // Get the function and setup the context.
-  mov(r1, Operand(Handle<JSFunction>(function)));
+  LoadHeapObject(r1, Handle<JSFunction>(function));

[Vyacheslav Egorov (Chromium), 2011/10/12 12:36:05]

Some callers of InvokeFunction are not handlified and use raw pointer across
invocation of InvokeFunction. see for example CompileStringFromCharCodeCall

variable name is used after InvokeFunction is called.

   ldr(cp, FieldMemOperand(r1, JSFunction::kContextOffset));
 
   // Invoke the cached code.