4a4bcda388
This introduces 2^16 as an upper limit for the allowed value range of a table switch on all architectures. It also fixes several overflows in the table size calculation. R=bmeurer@chromium.org TEST=mjsunit/regress/regress-crbug-736633 BUG=chromium:736633 Change-Id: I931bd226c99eb8a1ae1770c159fc314ff650bf57 Reviewed-on: https://chromium-review.googlesource.com/566829 Reviewed-by: Benedikt Meurer <bmeurer@chromium.org> Commit-Queue: Michael Starzinger <mstarzinger@chromium.org> Cr-Commit-Position: refs/heads/master@{#46575}
22 lines
455 B
JavaScript
22 lines
455 B
JavaScript
// Copyright 2017 the V8 project authors. All rights reserved.
|
|
// Use of this source code is governed by a BSD-style license that can be
|
|
// found in the LICENSE file.
|
|
|
|
// Flags: --allow-natives-syntax
|
|
|
|
function f(x) {
|
|
switch (x | 0) {
|
|
case 0:
|
|
case 1:
|
|
case 2:
|
|
case -2147483644:
|
|
case 2147483647:
|
|
return x + 1;
|
|
}
|
|
return 0;
|
|
}
|
|
assertEquals(1, f(0));
|
|
assertEquals(2, f(1));
|
|
%OptimizeFunctionOnNextCall(f);
|
|
assertEquals(3, f(2));
|