src/codegen-ia32.cc - Issue 113266: Push revision 1914 which fixes crash in generated code for instanceof....

Keyboard Shortcuts

	File
u :	up to issue
j / k :	jump to file after / before current file
J / K :	jump to next file with a comment after / before current file
	Side-by-side diff
i :	toggle intra-line diffs
e :	expand all comments
c :	collapse all comments
s :	toggle showing all comments
n / p :	next / previous diff chunk or comment
N / P :	next / previous comment
<Up> / <Down> :	next / previous line

	Issue
u :	up to list of issues
j / k :	jump to patch after / before current patch
o / <Enter> :	open current patch in side-by-side view
i :	open current patch in unified diff view

	Issue List
j / k :	jump to issue after / before current issue
o / <Enter> :	open current issue

Unified Diff: src/codegen-ia32.cc

Issue 113266: Push revision 1914 which fixes crash in generated code for instanceof.... (Closed) Base URL: http://v8.googlecode.com/svn/branches/1.1/

Patch Set: Created 11 years, 7 months ago

Use n/p to move between diff chunks; N/P to move between comments. Draft comments are only viewable by you.

Jump to:

View side-by-side diff with in-line comments

Download patch

Index: src/codegen-ia32.cc

===================================================================

--- src/codegen-ia32.cc (revision 1905)

+++ src/codegen-ia32.cc (working copy)

@@ -7064,7 +7064,7 @@

__ j(zero, &slow, not_taken);

// Check that the left hand is a JS object.

- __ mov(eax, FieldOperand(eax, HeapObject::kMapOffset)); // ebx - object map

+ __ mov(eax, FieldOperand(eax, HeapObject::kMapOffset)); // eax - object map

__ movzx_b(ecx, FieldOperand(eax, Map::kInstanceTypeOffset)); // ecx - type

__ cmp(ecx, FIRST_JS_OBJECT_TYPE);

__ j(less, &slow, not_taken);

@@ -7076,6 +7076,8 @@

__ TryGetFunctionPrototype(edx, ebx, ecx, &slow);

// Check that the function prototype is a JS object.

+ __ test(ebx, Immediate(kSmiTagMask));

+ __ j(zero, &slow, not_taken);

__ mov(ecx, FieldOperand(ebx, HeapObject::kMapOffset));

__ movzx_b(ecx, FieldOperand(ecx, Map::kInstanceTypeOffset));

__ cmp(ecx, FIRST_JS_OBJECT_TYPE);

« no previous file with comments | « src/api.cc ('k') | test/mjsunit/regress/regress-341.js » ('j') | no next file with comments »