Bring r4460 to trunk.
This fixes an overwrite past the end of cache.
Review URL: http://codereview.chromium.org/1689004
git-svn-id: http://v8.googlecode.com/svn/trunk@4461 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
diff --git a/src/runtime.cc b/src/runtime.cc
index 5e43129..ab77018 100644
--- a/src/runtime.cc
+++ b/src/runtime.cc
@@ -10101,8 +10101,10 @@
cache->set(JSFunctionResultCache::kCacheSizeIndex, Smi::FromInt(size + 2));
return CacheMiss(cache, size, key);
} else {
- int target_index = (finger_index < cache->length()) ?
- finger_index + 2 : JSFunctionResultCache::kEntriesIndex;
+ int target_index = finger_index + JSFunctionResultCache::kEntrySize;
+ if (target_index == cache->length()) {
+ target_index = JSFunctionResultCache::kEntriesIndex;
+ }
return CacheMiss(cache, target_index, key);
}
}