Fix invalid array length check in TransitionElementsKindStub.

src/code-stubs-hydrogen.cc

 // Copyright 2012 the V8 project authors. All rights reserved.
 // Redistribution and use in source and binary forms, with or without
 // modification, are permitted provided that the following conditions are
 // met:
 //
 //     * Redistributions of source code must retain the above copyright
 //       notice, this list of conditions and the following disclaimer.
 //     * Redistributions in binary form must reproduce the above
 //       copyright notice, this list of conditions and the following
 //       disclaimer in the documentation and/or other materials provided
@@ skipping 523 matching lines @@
 
   HValue* js_array = GetParameter(0);
   HValue* map = GetParameter(1);
 
   info()->MarkAsSavesCallerDoubles();
 
   if (AllocationSite::GetMode(from_kind, to_kind) == TRACK_ALLOCATION_SITE) {
     Add<HTrapAllocationMemento>(js_array);
   }
 
+  HInstruction* elements = AddLoadElements(js_array);
+
+  HInstruction* elements_length = AddLoadFixedArrayLength(elements);
+
+  IfBuilder if_builder(this);
+
+  if_builder.IfNot<HCompareNumericAndBranch>(elements_length,
+                                             graph()->GetConstant0(),
+                                             Token::EQ);
+  if_builder.Then();

[mvstanton, 2013/07/16 13:01:07]

There might still be an issue here. What if you are going from a 0 size DOUBLE
array to a 0 size TAGGED array. I think that you need to do more than just set
the map of the array. You also need to point the elements property to the
factory->fixed_array_map(), because it's currently pointing to the
factory->fixed_double_array_map(). I guess this would be the "else" case for
your IfBuilder.

+
   HInstruction* array_length =
       AddLoad(js_array, HObjectAccess::ForArrayLength());
   array_length->set_type(HType::Smi());
 
-  IfBuilder if_builder(this);
-
-  if_builder.IfNot<HCompareNumericAndBranch>(array_length,
-                                             graph()->GetConstant0(),
-                                             Token::EQ);
-  if_builder.Then();
-
-  HInstruction* elements = AddLoadElements(js_array);
-
-  HInstruction* elements_length = AddLoadFixedArrayLength(elements);
-
   BuildGrowElementsCapacity(js_array, elements, from_kind, to_kind,
                             array_length, elements_length);
 
   if_builder.End();
 
   AddStore(js_array, HObjectAccess::ForMap(), map);
 
   return js_array;
 }
 
@@ skipping 333 matching lines @@
   return value;
 }
 
 
 Handle<Code> StoreGlobalStub::GenerateCode() {
   return DoGenerateCode(this);
 }
 
 
 } }  // namespace v8::internal