diff --git a/src/crankshaft/hydrogen.cc b/src/crankshaft/hydrogen.cc index a898c44574..36dce482bc 100644 --- a/src/crankshaft/hydrogen.cc +++ b/src/crankshaft/hydrogen.cc @@ -7508,6 +7508,12 @@ void HOptimizedGraphBuilder::BuildLoad(Property* expr, HValue* string = Pop(); HInstruction* char_code = BuildStringCharCodeAt(string, index); AddInstruction(char_code); + if (char_code->IsConstant()) { + HConstant* c_code = HConstant::cast(char_code); + if (c_code->HasNumberValue() && std::isnan(c_code->DoubleValue())) { + Add(DeoptimizeReason::kOutOfBounds, Deoptimizer::EAGER); + } + } instr = NewUncasted(char_code); } else if (expr->key()->IsPropertyName()) { diff --git a/test/mjsunit/regress/regress-crbug-665793.js b/test/mjsunit/regress/regress-crbug-665793.js new file mode 100644 index 0000000000..d445d5194e --- /dev/null +++ b/test/mjsunit/regress/regress-crbug-665793.js @@ -0,0 +1,12 @@ +// Copyright 2016 the V8 project authors. All rights reserved. +// Use of this source code is governed by a BSD-style license that can be +// found in the LICENSE file. + +// Flags: --allow-natives-syntax + +function foo() { + return 'x'[1]; +} +assertEquals(undefined, foo()); +%OptimizeFunctionOnNextCall(foo); +assertEquals(undefined, foo());