Fix dictionary element load to pass correct elements kind.
authorulan@chromium.org <ulan@chromium.org@ce2b1a6d-e550-0410-aec6-3dcde31c8c00>
Fri, 14 Feb 2014 15:52:24 +0000 (15:52 +0000)
committerulan@chromium.org <ulan@chromium.org@ce2b1a6d-e550-0410-aec6-3dcde31c8c00>
Fri, 14 Feb 2014 15:52:24 +0000 (15:52 +0000)
commit6744ff61ae1609f96795f022c446207cf9ccd7e8
treeb6503385b53de700d9515ff4674c8373cea8ad9a
parentc532977da3ee1fbd131c38a5450f80a615f7573e
Fix dictionary element load to pass correct elements kind.

Using FAST_SMI_ELEMENTS triggers optimization on 64-bit architectures that load
only the higher 32 bits of the element. If the element is a pointer to undefined
that has 0 in the higher half than it is erroneously treated as SMI 0.

BUG=v8:3158
LOG=N
TEST=mjsunit/sparse-array-reverse,mjsunit/regress/regress-3158.js
R=danno@chromium.org, ishell@chromium.org

Review URL: https://codereview.chromium.org/166653005

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@19387 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
src/hydrogen.cc
src/x64/lithium-codegen-x64.cc
test/mjsunit/mjsunit.status
test/mjsunit/regress/regress-3158.js [new file with mode: 0644]