Fix off-by-one error in AstTyper, part 2.

R=jkummerow@chromium.org

Review URL: https://codereview.chromium.org/112933002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18308 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

diff --git a/src/typing.h b/src/typing.h
index 6298e5a41b3d6824f45cc6879e408f48014ce9b0..a111ae5fd1594d14868ba2db80df27a34e2caf1e 100644 (file)
--- a/src/typing.h
+++ b/src/typing.h
@@ -83,8 +83,11 @@ class AstTyper: public AstVisitor {
   void ExitEffects() { store_ = store_.Pop(); }
 
   int variable_index(Variable* var) {
+    // Stack locals have the range [0 .. l]
+    // Parameters have the range [-1 .. p]
+    // We map this to [-p-2 .. -1, 0 .. l]
     return var->IsStackLocal() ? var->index() :
-           var->IsParameter() ? -var->index() - 1 : kNoVar;
+           var->IsParameter() ? -var->index() - 2 : kNoVar;
   }
 
   void VisitDeclarations(ZoneList<Declaration*>* declarations);

diff --git a/test/mjsunit/regress/regress-param-local-type.js b/test/mjsunit/regress/regress-param-local-type.js
index ed688a90f33ca5f0449a013f16a10ec990c2df3d..bf260900898923a5fe2471aed82eb9ce5f896bf2 100644 (file)
--- a/test/mjsunit/regress/regress-param-local-type.js
+++ b/test/mjsunit/regress/regress-param-local-type.js
@@ -42,3 +42,17 @@ f(1);
 %OptimizeFunctionOnNextCall(f);
 f(1);
 assertOptimized(f);
+
+
+function g() {  // 0th parameter (receiver) is tagged.
+  var s = '';   // First local has string type.
+  var n = 0;
+  var i = 1;
+  n = i + this;
+}
+
+g.call(1);
+g.call(1);
+%OptimizeFunctionOnNextCall(g);
+g.call(1);
+assertOptimized(g);