Bugfix for 349874: we incorrectly believe we saw a growing store
authormvstanton@chromium.org <mvstanton@chromium.org@ce2b1a6d-e550-0410-aec6-3dcde31c8c00>
Thu, 6 Mar 2014 13:07:51 +0000 (13:07 +0000)
committermvstanton@chromium.org <mvstanton@chromium.org@ce2b1a6d-e550-0410-aec6-3dcde31c8c00>
Thu, 6 Mar 2014 13:07:51 +0000 (13:07 +0000)
commit6115a006fdfc285e2a8b76590b95648bfd303474
tree3faf77b8fcfabbacfaf05b8277c96af0d7c37837
parentcd6f3ef0883233100a512c8c6ecbefc6f072ea0d
Bugfix for 349874: we incorrectly believe we saw a growing store

When we set an out of bounds array index, the index might be so large that
it causes the array to go to dictionary mode. It's better to avoid
"learning" that this was a growing store in that case.

This fix also partially reverts a fix for bug 347543, as this fix is
comprehensive and satisfies that repro case as well (partial revert of
v19591).

BUG=349874
LOG=N
R=verwaest@chromium.org

Review URL: https://codereview.chromium.org/188643002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@19691 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
src/a64/lithium-codegen-a64.cc
src/arm/lithium-codegen-arm.cc
src/ia32/lithium-codegen-ia32.cc
src/ic.cc
src/mips/lithium-codegen-mips.cc
src/objects.cc
src/objects.h
src/x64/lithium-codegen-x64.cc
test/mjsunit/regress/regress-349885.js [new file with mode: 0644]