Chromium Code Reviews
chromiumcodereview-hr@appspot.gserviceaccount.com (chromiumcodereview-hr) | Please choose your nickname with Settings | Help | Chromium Project | Gerrit Changes | Sign out
(297)

Issues Search
    My Issues | Starred     Open | Closed | All

Unified Diff: src/x64/codegen-x64.cc

Issue 5839002: Merge bleeding edge revision 6020 to 2.4 branch. (Closed)
Patch Set: Update patch-level. Untabify. Created 10 years ago
Use n/p to move between diff chunks; N/P to move between comments. Draft comments are only viewable by you.
Jump to:
View side-by-side diff with in-line comments
Download patch
« no previous file with comments | « src/version.cc ('k') | test/mjsunit/regress/regress-swapelements.js » ('j') | no next file with comments »
Expand Comments ('e') | Collapse Comments ('c') | Show Comments Hide Comments ('s')
Index: src/x64/codegen-x64.cc
diff --git a/src/x64/codegen-x64.cc b/src/x64/codegen-x64.cc
index 9e6ef3b524067cd68e31fd7e26e1c6bc4c32e480..23f030a23e58123b15f9de9f538733e7e4b5bfeb 100644
--- a/src/x64/codegen-x64.cc
+++ b/src/x64/codegen-x64.cc
@@ -6913,6 +6913,13 @@ void CodeGenerator::GenerateSwapElements(ZoneList<Expression*>* args) {
Condition both_smi = masm()->CheckBothSmi(index1.reg(), index2.reg());
deferred->Branch(NegateCondition(both_smi));
+ // Check that both indices are valid.
+ __ movq(tmp2.reg(), FieldOperand(object.reg(), JSArray::kLengthOffset));
+ __ cmpl(tmp2.reg(), index1.reg());
+ deferred->Branch(below_equal);
+ __ cmpl(tmp2.reg(), index2.reg());
+ deferred->Branch(below_equal);
+
// Bring addresses into index1 and index2.
__ SmiToInteger32(index1.reg(), index1.reg());
__ lea(index1.reg(), FieldOperand(tmp1.reg(),
« no previous file with comments | « src/version.cc ('k') | test/mjsunit/regress/regress-swapelements.js » ('j') | no next file with comments »

Powered by Google App Engine
This is Rietveld 408576698