v8/test/mjsunit/compiler/regress-445267.js
bmeurer ef41f70684 [turbofan] Fix invalid bounds check with overflowing offset.
TEST=mjsunit/compiler/regress-445267
BUG=chromium:445267
LOG=y

Review URL: https://codereview.chromium.org/825403002

Cr-Commit-Position: refs/heads/master@{#25945}
2014-12-29 10:01:15 +00:00

17 lines
443 B
JavaScript

// Copyright 2014 the V8 project authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
var foo = (function Module(stdlib, foreign, heap) {
"use asm";
var MEM16 = new stdlib.Int16Array(heap);
function foo(i) {
i = i|0;
i = MEM16[i + 2147483650 >> 1]|0;
return i;
}
return { foo: foo };
})(this, {}, new ArrayBuffer(64 * 1024)).foo;
foo(0);