A64: Fix write barrier input in KeyedStoreIC::GenerateSloppyArguments.

This fixes flaky crashes in gc-stress bot:
> Fatal error in ../src/incremental-marking.cc, line 84
> CHECK(obj->IsHeapObject()) failed

BUG=353551
LOG=N
TEST=test/mjsunit/regress/regress-353551.js
R=m.m.capewell@googlemail.com

Review URL: https://codereview.chromium.org/204453002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@20098 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

diff --git a/src/a64/ic-a64.cc b/src/a64/ic-a64.cc
index 18677f7..71d4c66 100644 (file)
--- a/src/a64/ic-a64.cc
+++ b/src/a64/ic-a64.cc
@@ -392,8 +392,11 @@ static MemOperand GenerateMappedArgumentsLookup(MacroAssembler* masm,
   // Load value from context and return it.
   __ Ldr(scratch2, FieldMemOperand(map, FixedArray::kHeaderSize));
   __ SmiUntag(scratch1);
-  __ Add(scratch2, scratch2, Context::kHeaderSize - kHeapObjectTag);
-  return MemOperand(scratch2, scratch1, LSL, kPointerSizeLog2);
+  __ Lsl(scratch1, scratch1, kPointerSizeLog2);
+  __ Add(scratch1, scratch1, Context::kHeaderSize - kHeapObjectTag);
+  // The base of the result (scratch2) is passed to RecordWrite in
+  // KeyedStoreIC::GenerateSloppyArguments and it must be a HeapObject.
+  return MemOperand(scratch2, scratch1);
 }
 
 

diff --git a/test/mjsunit/regress/regress-353551.js b/test/mjsunit/regress/regress-353551.js
new file mode 100644 (file)
index 0000000..c6e7856
--- /dev/null
+++ b/test/mjsunit/regress/regress-353551.js
@@ -0,0 +1,40 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+//     * Redistributions of source code must retain the above copyright
+//       notice, this list of conditions and the following disclaimer.
+//     * Redistributions in binary form must reproduce the above
+//       copyright notice, this list of conditions and the following
+//       disclaimer in the documentation and/or other materials provided
+//       with the distribution.
+//     * Neither the name of Google Inc. nor the names of its
+//       contributors may be used to endorse or promote products derived
+//       from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+var depth = 0;
+function __f_3(x) {
+  var __v_1 = arguments;
+  __v_1[1000] = 123;
+  depth++;
+  if (depth > 3000) return;
+  function __f_4() {
+    ++__v_1[0];
+    __f_3(0.5);
+  };
+  __f_4();
+}
+__f_3(0.5);