Fix invalid array length check in TransitionElementsKindStub.
authorbmeurer@chromium.org <bmeurer@chromium.org@ce2b1a6d-e550-0410-aec6-3dcde31c8c00>
Wed, 17 Jul 2013 08:32:28 +0000 (08:32 +0000)
committerbmeurer@chromium.org <bmeurer@chromium.org@ce2b1a6d-e550-0410-aec6-3dcde31c8c00>
Wed, 17 Jul 2013 08:32:28 +0000 (08:32 +0000)
commita72b5d6c4da0b7acc1e40895839f557a0c158752
tree63b13943e49a463c91568dc6cb340bac7db02532
parent397163f0c87a0938e4fa9f6f9704dc7488d8fa02
Fix invalid array length check in TransitionElementsKindStub.

The stub used to check the length of the JS array to see if
there's a need to duplicate the elements backing store. This
way it will not duplicate the elements array when going from
double to object even if the elements array is not the empty
fixed array. Later on it will then store pointers into a
FixedDoubleArray.

The native code stub used to check whether elements points to
the empty_fixed_array singleton instead of testing the length.
The Hydrogen stub does that as well now.

R=danno@chromium.org

Review URL: https://codereview.chromium.org/19289009

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@15701 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
src/code-stubs-hydrogen.cc
test/mjsunit/transition-elements-kind.js [new file with mode: 0644]