Fix for bug 245480. Calling new Array(a) with a single argument could

Fix for bug 245480. Calling new Array(a) with a single argument could result in creating a holey array with a packed elements kind.

BUG=245480
R=verwaest@chromium.org

Committed: https://code.google.com/p/v8/source/detail?r=15095

[mvstanton, 2013-06-12 17:17:47]

Here is the fix we discussed, thanks for the look.

[Toon Verwaest, 2013-06-12 17:26:01]

Added comments

https://codereview.chromium.org/16341004/diff/1/src/ia32/lithium-codegen-ia32.cc
File src/ia32/lithium-codegen-ia32.cc (right):

https://codereview.chromium.org/16341004/diff/1/src/ia32/lithium-codegen-ia32...
src/ia32/lithium-codegen-ia32.cc:4219: __ mov(ebx,
instr->hydrogen()->property_cell());
ebx and ecx below should be TempRegisters I presume? Does this work?

https://codereview.chromium.org/16341004/diff/1/test/mjsunit/regress/regress-...
File test/mjsunit/regress/regress-crbug-245480.js (right):

https://codereview.chromium.org/16341004/diff/1/test/mjsunit/regress/regress-...
test/mjsunit/regress/regress-crbug-245480.js:1: // Copyright 2012 the V8 project
authors. All rights reserved.
2013

https://codereview.chromium.org/16341004/diff/1/test/mjsunit/regress/regress-...
test/mjsunit/regress/regress-crbug-245480.js:123:
%OptimizeFunctionOnNextCall(f);
You can remove this line I presume, since you are optimizing the wrong function.

[Toon Verwaest, 2013-06-12 17:57:50]

lgtm

[mvstanton, 2013-06-12 17:58:12]

comments.

https://codereview.chromium.org/16341004/diff/1/src/ia32/lithium-codegen-ia32.cc
File src/ia32/lithium-codegen-ia32.cc (right):

https://codereview.chromium.org/16341004/diff/1/src/ia32/lithium-codegen-ia32...
src/ia32/lithium-codegen-ia32.cc:4219: __ mov(ebx,
instr->hydrogen()->property_cell());
On 2013/06/12 17:26:01, Toon Verwaest wrote:
> ebx and ecx below should be TempRegisters I presume? Does this work?

It's okay because the function is MarkAsCall(), so the register allocator will
spill/restore registers around this instruction.

https://codereview.chromium.org/16341004/diff/1/test/mjsunit/regress/regress-...
File test/mjsunit/regress/regress-crbug-245480.js (right):

https://codereview.chromium.org/16341004/diff/1/test/mjsunit/regress/regress-...
test/mjsunit/regress/regress-crbug-245480.js:1: // Copyright 2012 the V8 project
authors. All rights reserved.
On 2013/06/12 17:26:01, Toon Verwaest wrote:
> 2013

Done.

https://codereview.chromium.org/16341004/diff/1/test/mjsunit/regress/regress-...
test/mjsunit/regress/regress-crbug-245480.js:123:
%OptimizeFunctionOnNextCall(f);
On 2013/06/12 17:26:01, Toon Verwaest wrote:
> You can remove this line I presume, since you are optimizing the wrong
function.

Done.

[mvstanton, 2013-06-12 18:04:23]

Committed patchset #3 manually as r15095 (presubmit successful).