Out of bounds memory access in TestJSArrayForAllocationSiteInfo.

test/mjsunit/allocation-site-info.js

 // Copyright 2012 the V8 project authors. All rights reserved.
 // Redistribution and use in source and binary forms, with or without
 // modification, are permitted provided that the following conditions are
 // met:
 //
 //     * Redistributions of source code must retain the above copyright
 //       notice, this list of conditions and the following disclaimer.
 //     * Redistributions in binary form must reproduce the above
 //       copyright notice, this list of conditions and the following
 //       disclaimer in the documentation and/or other materials provided
@@ skipping 57 matching lines @@
 
 function assertKind(expected, obj, name_opt) {
   if (!support_smi_only_arrays &&
       expected == elements_kind.fast_smi_only) {
     expected = elements_kind.fast;
   }
   assertEquals(expected, getKind(obj), name_opt);
 }
 
 if (support_smi_only_arrays) {
-    function fastliteralcase(value) {
-        var literal = [1, 2, 3];
+    function fastliteralcase(literal, value) {
+        // var literal = [1, 2, 3];
         literal[0] = value;
         return literal;
     }
 
+    function get_standard_literal() {

[danno, 2013/01/21 12:38:18]

nit: maybe just get_literal()

+        var literal = [1, 2, 3];
+        return literal;
+    }
+
     // Case: [1,2,3] as allocation site
-    obj = fastliteralcase(1);
+    obj = fastliteralcase(get_standard_literal(), 1);
     assertKind(elements_kind.fast_smi_only, obj);
-    obj = fastliteralcase(1.5);
+    obj = fastliteralcase(get_standard_literal(), 1.5);
     assertKind(elements_kind.fast_double, obj);
-    obj = fastliteralcase(2);
+    obj = fastliteralcase(get_standard_literal(), 2);
     assertKind(elements_kind.fast_double, obj);
 
+    obj = fastliteralcase([5, 3, 2], 1.5);
+    assertKind(elements_kind.fast_double, obj);
+    obj = fastliteralcase([3, 6, 2], 1.5);
+    assertKind(elements_kind.fast_double, obj);
+    obj = fastliteralcase([2, 6, 3], 2);
+    assertKind(elements_kind.fast_smi_only, obj);
+
     // Verify that we will not pretransition the double->fast path.
-    obj = fastliteralcase("elliot");
+    obj = fastliteralcase(get_standard_literal(), "elliot");
     assertKind(elements_kind.fast, obj);
 
     // This fails until we turn off optimistic transitions to the
     // most general elements kind seen on keyed stores. It's a goal
     // to turn it off, but for now we need it.
     // obj = fastliteralcase(3);
     // assertKind(elements_kind.fast_double, obj);
 
     function fastliteralcase_smifast(value) {
         var literal = [1, 2, 3, 4];
         literal[0] = value;
         return literal;
     }
 
     obj = fastliteralcase_smifast(1);
     assertKind(elements_kind.fast_smi_only, obj);
     obj = fastliteralcase_smifast("carter");
     assertKind(elements_kind.fast, obj);
     obj = fastliteralcase_smifast(2);
     assertKind(elements_kind.fast, obj);
 }