projects / platform / upstream / v8.git / commit
? search:
summary | shortlog | log | commit | commitdiff | tree
(parent: 015f963) | patch
[turbofan] Properly emit bounds checks for typed array element loads.
authorbmeurer@chromium.org <bmeurer@chromium.org>
Wed, 8 Oct 2014 11:16:45 +0000 (11:16 +0000)
committerbmeurer@chromium.org <bmeurer@chromium.org>
Wed, 8 Oct 2014 11:16:45 +0000 (11:16 +0000)
commit9b306893a3d43679e9f8733d3ac9f30d3c85acd1
tree77466aef2617541fb1a118ce30613278bd56c12dtree | snapshot
parent015f963e8fbaa72bc04ffa9dbcfecf8a74f384aecommit | diff
[turbofan] Properly emit bounds checks for typed array element loads.

Also fix an awfull bug in simplified lowering.

TEST=cctest,mjsunit/asm
R=mstarzinger@chromium.org

Review URL: https://codereview.chromium.org/640603003

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@24463 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
src/compiler/js-typed-lowering.cc diff | blob | history
src/compiler/representation-change.h diff | blob | history
src/compiler/simplified-lowering.cc diff | blob | history
src/compiler/simplified-lowering.h diff | blob | history
test/cctest/compiler/test-representation-change.cc diff | blob | history
test/mjsunit/asm/float32array-outofbounds.js [new file with mode: 0644] blob
test/mjsunit/asm/float64array-outofbounds.js [new file with mode: 0644] blob
test/mjsunit/asm/int16array-outofbounds.js [new file with mode: 0644] blob
test/mjsunit/asm/int32array-outofbounds.js [new file with mode: 0644] blob
test/mjsunit/asm/uint8array-outofbounds.js [new file with mode: 0644] blob
Domain: Web Framework / Web Engine;