From 6d5f6914f78465d6f1348399f51486e131c51022 Mon Sep 17 00:00:00 2001 From: "bmeurer@chromium.org" Date: Thu, 23 Oct 2014 07:34:36 +0000 Subject: [PATCH] [turbofan] Currently we cannot handle typed arrays bigger than 2GiB. R=jarin@chromium.org Review URL: https://codereview.chromium.org/676643002 git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@24820 ce2b1a6d-e550-0410-aec6-3dcde31c8c00 --- src/compiler/js-typed-lowering.cc | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/src/compiler/js-typed-lowering.cc b/src/compiler/js-typed-lowering.cc index cc8d6ce79f..fb510e07ce 100644 --- a/src/compiler/js-typed-lowering.cc +++ b/src/compiler/js-typed-lowering.cc @@ -566,7 +566,8 @@ Reduction JSTypedLowering::ReduceJSLoadProperty(Node* node) { if (IsExternalArrayElementsKind(array->map()->elements_kind())) { ExternalArrayType type = array->type(); uint32_t byte_length; - if (array->byte_length()->ToUint32(&byte_length)) { + if (array->byte_length()->ToUint32(&byte_length) && + byte_length <= static_cast(kMaxInt)) { Handle elements = Handle::cast(handle(array->elements())); Node* pointer = jsgraph()->IntPtrConstant( @@ -603,7 +604,8 @@ Reduction JSTypedLowering::ReduceJSStoreProperty(Node* node) { if (IsExternalArrayElementsKind(array->map()->elements_kind())) { ExternalArrayType type = array->type(); uint32_t byte_length; - if (array->byte_length()->ToUint32(&byte_length)) { + if (array->byte_length()->ToUint32(&byte_length) && + byte_length <= static_cast(kMaxInt)) { Handle elements = Handle::cast(handle(array->elements())); Node* pointer = jsgraph()->IntPtrConstant(