Pickup two crash fixes from V8 tree:

http://code.google.com/p/v8/source/detail?r=2400
http://code.google.com/p/v8/source/detail?r=2399

Our next dropin will get both fixes.

1 files changed, 21 insertions, 8 deletions

diff --git a/V8Binding/v8/src/arm/codegen-arm.cc b/V8Binding/v8/src/arm/codegen-arm.cc
index a3176c2..a0e485b 100644
--- a/V8Binding/v8/src/arm/codegen-arm.cc
+++ b/V8Binding/v8/src/arm/codegen-arm.cc
@@ -2424,13 +2424,23 @@ void CodeGenerator::VisitConditional(Conditional* node) {
   JumpTarget exit;
   LoadConditionAndSpill(node->condition(), NOT_INSIDE_TYPEOF,
                         &then, &else_, true);
-  Branch(false, &else_);
-  then.Bind();
-  LoadAndSpill(node->then_expression(), typeof_state());
-  exit.Jump();
-  else_.Bind();
-  LoadAndSpill(node->else_expression(), typeof_state());
-  exit.Bind();
+  if (frame_ != NULL) {
+    Branch(false, &else_);
+  }
+  if (frame_ != NULL || then.is_linked()) {
+    then.Bind();
+    LoadAndSpill(node->then_expression(), typeof_state());
+  }
+  if (frame_ != NULL) {
+    exit.Jump();
+  }
+  if (else_.is_linked()) {
+    else_.Bind();
+    LoadAndSpill(node->else_expression(), typeof_state());
+  }
+  if (exit.is_linked()) {
+    exit.Bind();
+  }
   ASSERT(frame_->height() == original_height + 1);
 }
 
@@ -3591,7 +3601,10 @@ void CodeGenerator::VisitUnaryOperation(UnaryOperation* node) {
                           false_target(),
                           true_target(),
                           true);
-    cc_reg_ = NegateCondition(cc_reg_);
+    // LoadConditionAndSpill might emit only unconditional jumps to
+    // the targets in which case cc_reg_ is not set.  When that
+    // happens, don't attempt to negate the condition.
+    if (has_cc()) cc_reg_ = NegateCondition(cc_reg_);
 
   } else if (op == Token::DELETE) {
     Property* property = node->expression()->AsProperty();