AuroraMiddleware/v8
1
0
Fork 0
Code Issues 2 Pull Requests Releases Wiki Activity

HGraphBuilder::BuildJSObjectCheck: Tighten instance type comparison

Browse Source 
R=danno@chromium.org

Review URL: https://codereview.chromium.org/366083005

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@22206 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
This commit is contained in:
jkummerow@chromium.org 2014-07-03 16:32:23 +00:00
parent cff28953aa
commit 70811b5d7b
1 changed files with 2 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
src/hydrogen.cc
View File

@ -1431,7 +1431,8 @@ void HGraphBuilder::BuildJSObjectCheck(HValue* receiver,
mask);
HValue* sub_result = AddUncasted<HSub>(and_result,
Add<HConstant>(JS_OBJECT_TYPE));
Add<HBoundsCheck>(sub_result, Add<HConstant>(0x100 - JS_OBJECT_TYPE));
Add<HBoundsCheck>(sub_result,
Add<HConstant>(LAST_JS_OBJECT_TYPE + 1 - JS_OBJECT_TYPE));
}