Merge r4182 to trunk.
Fixes a crash in the code generator.
Review URL: http://codereview.chromium.org/1098002
git-svn-id: http://v8.googlecode.com/svn/trunk@4183 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
diff --git a/src/ia32/codegen-ia32.cc b/src/ia32/codegen-ia32.cc
index 9cc4b2e..26fd1db 100644
--- a/src/ia32/codegen-ia32.cc
+++ b/src/ia32/codegen-ia32.cc
@@ -3765,7 +3765,7 @@
// The update expression resets the type of the loop variable. So we
// set it to smi before compiling the test expression.
- if (node->is_fast_smi_loop()) {
+ if (node->is_fast_smi_loop() && has_valid_frame()) {
// Set number type of the loop variable to smi.
Slot* slot = node->loop_variable()->slot();
ASSERT(slot->type() == Slot::LOCAL);
diff --git a/src/version.cc b/src/version.cc
index bdc6756..d45b71e 100644
--- a/src/version.cc
+++ b/src/version.cc
@@ -35,7 +35,7 @@
#define MAJOR_VERSION 2
#define MINOR_VERSION 1
#define BUILD_NUMBER 6
-#define PATCH_LEVEL 1
+#define PATCH_LEVEL 2
#define CANDIDATE_VERSION false
// Define SONAME to have the SCons build the put a specific SONAME into the
diff --git a/test/mjsunit/compiler/loopcount.js b/test/mjsunit/compiler/loopcount.js
index 0eadc38..da9bc6b 100644
--- a/test/mjsunit/compiler/loopcount.js
+++ b/test/mjsunit/compiler/loopcount.js
@@ -54,5 +54,33 @@
}
assertEquals(-0x40000001, f5());
+
function f6() { var x = 0x3fffffff; x++; return x+1; }
assertEquals(0x40000001, f6());
+
+
+function f7() {
+ var i;
+ for (i = 0x3ffffffd; i <= 0x3ffffffe; i++) {}
+ i++; i = i + 1;
+ return i;
+}
+assertEquals(0x40000001, f7());
+
+
+function f8() {
+ var i;
+ for (i = 0x3ffffffd; i <= 0x3fffffff; i++) {}
+ i++; i++;
+ return i;
+}
+assertEquals(0x40000002, f8());
+
+
+function f9() {
+ var i;
+ for (i = 0; i < 42; i++) {
+ return 42;
+ }
+}
+assertEquals(42, f9());