Fix: KeyedStoreGeneric must check for writable array length

Fix: KeyedStoreGeneric must check for writable array length

This has been broken since forever.

BUG=v8:5669
Review-Url: https://codereview.chromium.org/2610343002
Cr-Commit-Position: refs/heads/master@{#42219}
Committed: https://chromium.googlesource.com/v8/v8/+/93a357c7079deda5c8eb9831da0e5f3cb638cff3

[Jakob Kummerow, 2017-01-05 13:07:00]

jkummerow@chromium.org changed reviewers:
+ danno@chromium.org

[Jakob Kummerow, 2017-01-05 13:07:00]

Please review at your convenience.

[danno, 2017-01-10 01:27:13]

lgtm with suggestion/comment

https://codereview.chromium.org/2610343002/diff/1/src/ic/keyed-store-generic.cc
File src/ic/keyed-store-generic.cc (right):

https://codereview.chromium.org/2610343002/diff/1/src/ic/keyed-store-generic....
src/ic/keyed-store-generic.cc:237: GotoIf(WordEqual(SmiAnd(details, mask_node),
mask_node), slow);
What about:

GotoIf(IsSetWord(BitcastTaggedToWord(details),
PropertyDetails::kAttributesReadOnlyMask), slow);

[Jakob Kummerow, 2017-01-10 11:53:46]

Thanks for the review.

https://codereview.chromium.org/2610343002/diff/1/src/ic/keyed-store-generic.cc
File src/ic/keyed-store-generic.cc (right):

https://codereview.chromium.org/2610343002/diff/1/src/ic/keyed-store-generic....
src/ic/keyed-store-generic.cc:237: GotoIf(WordEqual(SmiAnd(details, mask_node),
mask_node), slow);
On 2017/01/10 01:27:12, danno wrote:
> What about:
> 
> GotoIf(IsSetWord(BitcastTaggedToWord(details),
> PropertyDetails::kAttributesReadOnlyMask), slow);
> 

As suggested, that compares a Smi against an untagged int, which is incorrect.
It would need "SmiUntag" instead of BitcastTaggedToWord, which adds an
additional instruction I'd rather avoid.

Keeping as-is unless you feel strongly about it.

[Jakob Kummerow, 2017-01-10 11:53:57]

The CQ bit was checked by jkummerow@chromium.org

[commit-bot: I haz the power, 2017-01-10 11:54:05]

CQ is trying da patch. Follow status at
 
https://chromium-cq-status.appspot.com/v2/patch-status/codereview.chromium.or...

[Jakob Kummerow, 2017-01-10 12:03:53]

The CQ bit was unchecked by jkummerow@chromium.org

[Jakob Kummerow, 2017-01-11 10:27:57]

Refactored as requested.

[Jakob Kummerow, 2017-01-11 10:28:04]

The CQ bit was checked by jkummerow@chromium.org to run a CQ dry run

[commit-bot: I haz the power, 2017-01-11 10:28:13]

Dry run: CQ is trying da patch. Follow status at
 
https://chromium-cq-status.appspot.com/v2/patch-status/codereview.chromium.or...

[commit-bot: I haz the power, 2017-01-11 11:19:27]

The CQ bit was unchecked by commit-bot@chromium.org

[commit-bot: I haz the power, 2017-01-11 11:19:28]

Dry run: This issue passed the CQ dry run.

[danno, 2017-01-11 11:35:22]

Still lgtm. Thanks for working my feedback in!

[Jakob Kummerow, 2017-01-11 11:36:04]

The CQ bit was checked by jkummerow@chromium.org

[commit-bot: I haz the power, 2017-01-11 11:36:10]

CQ is trying da patch. Follow status at
 
https://chromium-cq-status.appspot.com/v2/patch-status/codereview.chromium.or...

[commit-bot: I haz the power, 2017-01-11 11:37:45]

CQ is committing da patch.

Bot data: {"patchset_id": 20001, "attempt_start_ts": 1484134564491030,
"parent_rev": "8713dc57775726e235d8449d7284ab411c3349d9", "commit_rev":
"93a357c7079deda5c8eb9831da0e5f3cb638cff3"}

[commit-bot: I haz the power, 2017-01-11 11:37:50]

Description was changed from

==========
Fix: KeyedStoreGeneric must check for writable array length

This has been broken since forever.

BUG=v8:5669
==========

to

==========
Fix: KeyedStoreGeneric must check for writable array length

This has been broken since forever.

BUG=v8:5669

Review-Url: https://codereview.chromium.org/2610343002
Cr-Commit-Position: refs/heads/master@{#42219}
Committed:
https://chromium.googlesource.com/v8/v8/+/93a357c7079deda5c8eb9831da0e5f3cb63...
==========

[commit-bot: I haz the power, 2017-01-11 11:37:51]

Committed patchset #2 (id:20001) as
https://chromium.googlesource.com/v8/v8/+/93a357c7079deda5c8eb9831da0e5f3cb63...