Experimental: fix a pair of bugs in the frame's sync state. In two...

src/virtual-frame-ia32.cc

 // Copyright 2008 the V8 project authors. All rights reserved.
 // Redistribution and use in source and binary forms, with or without
 // modification, are permitted provided that the following conditions are
 // met:
 //
 //     * Redistributions of source code must retain the above copyright
 //       notice, this list of conditions and the following disclaimer.
 //     * Redistributions in binary form must reproduce the above
 //       copyright notice, this list of conditions and the following
 //       disclaimer in the documentation and/or other materials provided
@@ skipping 457 matching lines @@
             stack_pointer_ = i + 1;
             __ add(Operand(esp),
                    Immediate((stack_pointer_ - i) * kPointerSize));
           }
           stack_pointer_--;
           __ pop(target.reg());
         }
       } else {
         // Source is constant.
         __ Set(target.reg(), Immediate(source.handle()));
+        if (target.is_synced()) {
+          if (i > stack_pointer_) {
+            SyncRange(stack_pointer_ + 1, i);
+          }
+          SyncElementAt(i);
+        }
       }
       Use(target.reg());
       elements_[i] = target;
     }
   }
 
   // At this point, the frames should be identical.
   ASSERT(stack_pointer_ == expected->stack_pointer_);
 #ifdef DEBUG
   for (int i = 0; i < elements_.length(); i++) {
@@ skipping 129 matching lines @@
     elements_[index] = new_element;
     Use(temp);
     elements_.Add(new_element);
 
     // Finally, move the element at the index into its new location.
     elements_[index].set_sync();
     __ mov(temp, Operand(ebp, fp_relative(index)));
 
     cgen_->allocator()->Unuse(temp);
   } else {
-    // For constants and registers, add a copy of the element to the
-    // top of the frame.
+    // For constants and registers, add an (unsynced) copy of the element to
+    // the top of the frame.
     ASSERT(element.is_register() || element.is_constant());
     if (element.is_register()) {
       Use(element.reg());
     }
+    element.clear_sync();
     elements_.Add(element);
   }
 }
 
 
 void VirtualFrame::StoreToFrameSlotAt(int index) {
   // Store the value on top of the frame to the virtual frame slot at a
   // given index.  The value on top of the frame is left in place.
   ASSERT(index >= 0);
   ASSERT(index < elements_.length());
@@ skipping 197 matching lines @@
       return false;
     }
   }
   return true;
 }
 #endif
 
 #undef __
 
 } }  // namespace v8::internal