AuroraMiddleware/v8
1
0
Fork 0
Code Issues 2 Pull Requests Releases Wiki Activity

[turbofan] Correctify lowering of Uint8ClampedArray buffer access.

Browse Source 
TEST=mjsunit/compiler/regress-444508.js
BUG=chromium:444508
LOG=y
R=machenbach@chromium.org

Review URL: https://codereview.chromium.org/794013004

Cr-Commit-Position: refs/heads/master@{#25916}
This commit is contained in:
Benedikt Meurer 2014-12-22 09:27:42 +01:00
parent 1ed16c587e
commit 65e69497ab
3 changed files with 12 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
src/compiler/js-typed-lowering.cc
View File

@ -781,7 +781,6 @@ Reduction JSTypedLowering::ReduceJSLoadProperty(Node* node) {
double const byte_length = array->byte_length()->Number();
CHECK_LT(k, arraysize(shifted_int32_ranges_));
if (IsExternalArrayElementsKind(array->map()->elements_kind()) &&
access.external_array_type() != kExternalUint8ClampedArray &&
key_type->Is(shifted_int32_ranges_[k]) && byte_length <= kMaxInt) {
// JSLoadProperty(typed-array, int32)
Handle<ExternalArray> elements =

3
src/compiler/simplified-operator.cc
View File

@ -28,6 +28,7 @@ std::ostream& operator<<(std::ostream& os, BaseTaggedness base_taggedness) {
MachineType BufferAccess::machine_type() const {
switch (external_array_type_) {
case kExternalUint8Array:
case kExternalUint8ClampedArray:
return kMachUint8;
case kExternalInt8Array:
return kMachInt8;
@ -43,8 +44,6 @@ MachineType BufferAccess::machine_type() const {
return kMachFloat32;
case kExternalFloat64Array:
return kMachFloat64;
case kExternalUint8ClampedArray:
break;
}
UNREACHABLE();
return kMachNone;

11
test/mjsunit/compiler/regress-444508.js Normal file
View File

@ -0,0 +1,11 @@
// Copyright 2014 the V8 project authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
(function Module(stdlib, foreign, heap) {
"use asm";
// This is not valid asm.js, but should nevertheless work.
var MEM = new Uint8ClampedArray(heap);
function foo(i) { MEM[0] = 1; }
return {foo: foo};
})(this, {}, new ArrayBuffer(64 * 1024)).foo();