[turbofan] Correctify lowering of Uint8ClampedArray buffer access.

TEST=mjsunit/compiler/regress-444508.js
BUG=chromium:444508
LOG=y
R=machenbach@chromium.org

Review URL: https://codereview.chromium.org/794013004

Cr-Commit-Position: refs/heads/master@{#25916}

diff --git a/src/compiler/js-typed-lowering.cc b/src/compiler/js-typed-lowering.cc
index f5bb09d1b2016927404848c609d8a0683302614a..2338866d6d2274830dff5b132128ca3f9216659b 100644 (file)
--- a/src/compiler/js-typed-lowering.cc
+++ b/src/compiler/js-typed-lowering.cc
@@ -781,7 +781,6 @@ Reduction JSTypedLowering::ReduceJSLoadProperty(Node* node) {
     double const byte_length = array->byte_length()->Number();
     CHECK_LT(k, arraysize(shifted_int32_ranges_));
     if (IsExternalArrayElementsKind(array->map()->elements_kind()) &&
-        access.external_array_type() != kExternalUint8ClampedArray &&
         key_type->Is(shifted_int32_ranges_[k]) && byte_length <= kMaxInt) {
       // JSLoadProperty(typed-array, int32)
       Handle<ExternalArray> elements =

diff --git a/src/compiler/simplified-operator.cc b/src/compiler/simplified-operator.cc
index 4900048829c889c7dacbaf18259817f6dcda0472..e082a4b30a827f68001b7c5772e5d660cf176cd0 100644 (file)
--- a/src/compiler/simplified-operator.cc
+++ b/src/compiler/simplified-operator.cc
@@ -28,6 +28,7 @@ std::ostream& operator<<(std::ostream& os, BaseTaggedness base_taggedness) {
 MachineType BufferAccess::machine_type() const {
   switch (external_array_type_) {
     case kExternalUint8Array:
+    case kExternalUint8ClampedArray:
       return kMachUint8;
     case kExternalInt8Array:
       return kMachInt8;
@@ -43,8 +44,6 @@ MachineType BufferAccess::machine_type() const {
       return kMachFloat32;
     case kExternalFloat64Array:
       return kMachFloat64;
-    case kExternalUint8ClampedArray:
-      break;
   }
   UNREACHABLE();
   return kMachNone;

diff --git a/test/mjsunit/compiler/regress-444508.js b/test/mjsunit/compiler/regress-444508.js
new file mode 100644 (file)
index 0000000..e7d51ae
--- /dev/null
+++ b/test/mjsunit/compiler/regress-444508.js
@@ -0,0 +1,11 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+(function Module(stdlib, foreign, heap) {
+  "use asm";
+  // This is not valid asm.js, but should nevertheless work.
+  var MEM = new Uint8ClampedArray(heap);
+  function foo(i) { MEM[0] = 1; }
+  return {foo: foo};
+})(this, {}, new ArrayBuffer(64 * 1024)).foo();