From 7ceeb471f77650f55592056fa58cc296127d7a00 Mon Sep 17 00:00:00 2001 From: "verwaest@chromium.org" Date: Thu, 29 Nov 2012 08:37:41 +0000 Subject: [PATCH] MIPS: Ensure double arrays are filled with holes when extended from variations of empty arrays. Port r13056 (9b2c1725) BUG= TEST= Review URL: https://chromiumcodereview.appspot.com/11411253 Patch from Akos Palfi . git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13083 ce2b1a6d-e550-0410-aec6-3dcde31c8c00 --- src/mips/stub-cache-mips.cc | 23 ++++++++++++++++++++--- 1 file changed, 20 insertions(+), 3 deletions(-) diff --git a/src/mips/stub-cache-mips.cc b/src/mips/stub-cache-mips.cc index 85497b5..fda30df 100644 --- a/src/mips/stub-cache-mips.cc +++ b/src/mips/stub-cache-mips.cc @@ -4843,14 +4843,31 @@ void KeyedStoreStubCompiler::GenerateStoreFastDoubleElement( __ AllocateInNewSpace(size, elements_reg, scratch1, scratch2, &slow, TAG_OBJECT); - // Initialize the new FixedDoubleArray. Leave elements unitialized for - // efficiency, they are guaranteed to be initialized before use. + // Initialize the new FixedDoubleArray. __ LoadRoot(scratch1, Heap::kFixedDoubleArrayMapRootIndex); __ sw(scratch1, FieldMemOperand(elements_reg, JSObject::kMapOffset)); __ li(scratch1, Operand(Smi::FromInt(JSArray::kPreallocatedArrayElements))); __ sw(scratch1, FieldMemOperand(elements_reg, FixedDoubleArray::kLengthOffset)); + __ li(scratch1, Operand(kHoleNanLower32)); + __ li(scratch2, Operand(kHoleNanUpper32)); + for (int i = 1; i < JSArray::kPreallocatedArrayElements; i++) { + int offset = FixedDoubleArray::OffsetOfElementAt(i); + __ sw(scratch1, FieldMemOperand(elements_reg, offset)); + __ sw(scratch2, FieldMemOperand(elements_reg, offset + kPointerSize)); + } + + __ StoreNumberToDoubleElements(value_reg, + key_reg, + // All registers after this are overwritten. + elements_reg, + scratch1, + scratch2, + scratch3, + scratch4, + &transition_elements_kind); + // Install the new backing store in the JSArray. __ sw(elements_reg, FieldMemOperand(receiver_reg, JSObject::kElementsOffset)); @@ -4863,7 +4880,7 @@ void KeyedStoreStubCompiler::GenerateStoreFastDoubleElement( __ sw(length_reg, FieldMemOperand(receiver_reg, JSArray::kLengthOffset)); __ lw(elements_reg, FieldMemOperand(receiver_reg, JSObject::kElementsOffset)); - __ jmp(&finish_store); + __ Ret(); __ bind(&check_capacity); // Make sure that the backing store can hold additional elements. -- 2.7.4