From: dcarney@chromium.org <dcarney@chromium.org@ce2b1a6d-e550-0410-aec6-3dcde31c8c00>
Date: Thu, 5 Dec 2013 12:38:50 +0000 (+0000)
Subject: Fix parameter passing in callback store ics on arm
X-Git-Tag: upstream/4.7.83~11416
X-Git-Url: http://review.tizen.org/git/?a=commitdiff_plain;h=69314e1f47d1f6d710116fffff8aec720fcf9ef3;p=platform%2Fupstream%2Fv8.git

Fix parameter passing in callback store ics on arm

R=svenpanne@chromium.org

BUG=

Review URL: https://codereview.chromium.org/93873007

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18260 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
---

diff --git a/src/arm/stub-cache-arm.cc b/src/arm/stub-cache-arm.cc
index 265265d..2fc80fb 100644
--- a/src/arm/stub-cache-arm.cc
+++ b/src/arm/stub-cache-arm.cc
@@ -911,12 +911,12 @@ static void GenerateFastApiCall(MacroAssembler* masm,
   __ str(receiver, MemOperand(sp, FCA::kHolderIndex * kPointerSize));
   // Write receiver to stack frame.
   int index = stack_space - 1;
-  __ str(receiver, MemOperand(sp, index * kPointerSize));
+  __ str(receiver, MemOperand(sp, index-- * kPointerSize));
   // Write the arguments to stack frame.
   for (int i = 0; i < argc; i++) {
     ASSERT(!receiver.is(values[i]));
     ASSERT(!scratch.is(values[i]));
-    __ str(receiver, MemOperand(sp, index-- * kPointerSize));
+    __ str(values[i], MemOperand(sp, index-- * kPointerSize));
   }
 
   GenerateFastApiDirectCall(masm, optimization, argc, true);
diff --git a/test/cctest/test-accessors.cc b/test/cctest/test-accessors.cc
index 142687b..2c257ee 100644
--- a/test/cctest/test-accessors.cc
+++ b/test/cctest/test-accessors.cc
@@ -205,21 +205,22 @@ THREADED_TEST(AccessorIC) {
     "var result = [];"
     "var key_0 = 'x0';"
     "var key_1 = 'x1';"
-    "for (var i = 0; i < 10; i++) {"
+    "for (var j = 0; j < 10; j++) {"
+    "  var i = 4*j;"
     "  holder.x0 = i;"
     "  result.push(obj.x0);"
-    "  holder.x1 = i;"
+    "  holder.x1 = i + 1;"
     "  result.push(obj.x1);"
-    "  holder[key_0] = i;"
+    "  holder[key_0] = i + 2;"
     "  result.push(obj[key_0]);"
-    "  holder[key_1] = i;"
+    "  holder[key_1] = i + 3;"
     "  result.push(obj[key_1]);"
     "}"
     "result"));
   CHECK_EQ(40, array->Length());
   for (int i = 0; i < 40; i++) {
     v8::Handle<Value> entry = array->Get(v8::Integer::New(i));
-    CHECK_EQ(v8::Integer::New(i/4), entry);
+    CHECK_EQ(v8::Integer::New(i), entry);
   }
 }