X87: Fix uninitialized FixedArray potentially being left behind by ElementsTransition...

port r24498.

original commit message:
  Fix uninitialized FixedArray potentially being left behind by ElementsTransitionGenerator::Generate.

BUG=
R=weiliang.lin@intel.com

Review URL: https://codereview.chromium.org/643793002

Patch from Chunyang Dai <chunyang.dai@intel.com>.

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@24508 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

diff --git a/src/x87/codegen-x87.cc b/src/x87/codegen-x87.cc
index e33959e65b4ce3891cb81fa4c86fb2b3efef4053..1321461a14ffa109cfefcd6e897138415c9129cd 100644 (file)
--- a/src/x87/codegen-x87.cc
+++ b/src/x87/codegen-x87.cc
@@ -380,6 +380,19 @@ void ElementsTransitionGenerator::GenerateDoubleToObject(
   __ mov(FieldOperand(eax, FixedArray::kLengthOffset), ebx);
   __ mov(edi, FieldOperand(edx, JSObject::kElementsOffset));
 
+  // Allocating heap numbers in the loop below can fail and cause a jump to
+  // gc_required. We can't leave a partly initialized FixedArray behind,
+  // so pessimistically fill it with holes now.
+  Label initialization_loop, initialization_loop_entry;
+  __ jmp(&initialization_loop_entry, Label::kNear);
+  __ bind(&initialization_loop);
+  __ mov(FieldOperand(eax, ebx, times_2, FixedArray::kHeaderSize),
+         masm->isolate()->factory()->the_hole_value());
+  __ bind(&initialization_loop_entry);
+  __ sub(ebx, Immediate(Smi::FromInt(1)));
+  __ j(not_sign, &initialization_loop);
+
+  __ mov(ebx, FieldOperand(edi, FixedDoubleArray::kLengthOffset));
   __ jmp(&entry);
 
   // ebx: target map