AuroraMiddleware/v8
1
0
Fork 0
Code Issues 2 Pull Requests Releases Wiki Activity

Do not eliminate bounds checks for "<const> - x".

Browse Source 
Before this change, bounds check elimination treated "<const> - x" as
"x - <const>".

R=yangguo@chromium.org
BUG=385054
TEST=test/mjsunit/regress/regress-385054.js
LOG=N

Review URL: https://codereview.chromium.org/339583003

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@21859 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
This commit is contained in:
jarin@chromium.org 2014-06-16 13:43:50 +00:00
parent 2591003da5
commit f69bb7fcc3
2 changed files with 17 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
src/hydrogen-bce.cc
View File

@ -47,10 +47,7 @@ class BoundsCheckKey : public ZoneObject {
} else if (check->index()->IsSub()) {
HSub* index = HSub::cast(check->index());
is_sub = true;
if (index->left()->IsConstant()) {
constant = HConstant::cast(index->left());
index_base = index->right();
} else if (index->right()->IsConstant()) {
if (index->right()->IsConstant()) {
constant = HConstant::cast(index->right());
index_base = index->left();
}

16
test/mjsunit/regress/regress-385054.js Normal file
View File

@ -0,0 +1,16 @@
// Copyright 2014 the V8 project authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
// Flags: --allow-natives-syntax
function f(x) {
var a = [1, 2];
a[x];
return a[0 - x];
}
f(0);
f(0);
%OptimizeFunctionOnNextCall(f);
assertEquals(undefined, f(1));