f69bb7fcc3
Before this change, bounds check elimination treated "<const> - x" as "x - <const>". R=yangguo@chromium.org BUG=385054 TEST=test/mjsunit/regress/regress-385054.js LOG=N Review URL: https://codereview.chromium.org/339583003 git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@21859 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
17 lines
341 B
JavaScript
17 lines
341 B
JavaScript
// Copyright 2014 the V8 project authors. All rights reserved.
|
|
// Use of this source code is governed by a BSD-style license that can be
|
|
// found in the LICENSE file.
|
|
|
|
// Flags: --allow-natives-syntax
|
|
|
|
function f(x) {
|
|
var a = [1, 2];
|
|
a[x];
|
|
return a[0 - x];
|
|
}
|
|
|
|
f(0);
|
|
f(0);
|
|
%OptimizeFunctionOnNextCall(f);
|
|
assertEquals(undefined, f(1));
|