Array.prototype.indexOf: Don't exclude length 2**32-1 from fast path.

I see no reason why it was excluded.

Bug: v8:8386
Change-Id: I291b12444b890db1636b00dec1837e1634b23b35
Reviewed-on: https://chromium-review.googlesource.com/c/1307428
Reviewed-by: Sigurd Schneider <sigurds@chromium.org>
Commit-Queue: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#57145}
This commit is contained in:
Georg Neis 2018-10-30 16:20:59 +01:00 committed by Commit Bot
parent 192bee6bac
commit a1d7dc4059

View File

@ -896,9 +896,9 @@ RUNTIME_FUNCTION(Runtime_ArrayIndexOf) {
}
}
// If the receiver is not a special receiver type, and the length is a valid
// element index, perform fast operation tailored to specific ElementsKinds.
if (!object->map()->IsSpecialReceiverMap() && len < kMaxUInt32 &&
// If the receiver is not a special receiver type, and the length fits
// uint32_t, perform fast operation tailored to specific ElementsKinds.
if (!object->map()->IsSpecialReceiverMap() && len <= kMaxUInt32 &&
JSObject::PrototypeHasNoElements(isolate, JSObject::cast(*object))) {
Handle<JSObject> obj = Handle<JSObject>::cast(object);
ElementsAccessor* elements = obj->GetElementsAccessor();