• binji's avatar
    [SAB] Validate index before value conversion using ToIndex · 7b300ba2
    binji authored
    It's required by the spec -- and observable -- that the index be validated
    before the conversion of the value(s) via ToInteger.
    
    The previous implementation also had an old test for validating the atomic
    index, which has now been switched to ToIndex.
    
    This also exposed an issue in the ia32 code generator: cmpxchg_b requires a
    byte register, but the ia32 instruction selector was ensuring that the
    new_value was a byte register, not the TempRegister. This change forces the
    temp register to use edx, which always can be used as a byte register (dl).
    This is the same behavior as currently used in UseByteRegister.
    
    BUG=v8:4614
    R=jarin@chromium.org,jkummerow@chromium.org
    
    Review-Url: https://codereview.chromium.org/2814753003
    Cr-Commit-Position: refs/heads/master@{#44626}
    7b300ba2
atomics.js 20.4 KB