[turbofan] Currently we cannot handle typed arrays bigger than 2GiB.

R=jarin@chromium.org

Review URL: https://codereview.chromium.org/676643002

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@24820 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

diff --git a/src/compiler/js-typed-lowering.cc b/src/compiler/js-typed-lowering.cc
index cc8d6ce..fb510e0 100644 (file)
--- a/src/compiler/js-typed-lowering.cc
+++ b/src/compiler/js-typed-lowering.cc
@@ -566,7 +566,8 @@ Reduction JSTypedLowering::ReduceJSLoadProperty(Node* node) {
     if (IsExternalArrayElementsKind(array->map()->elements_kind())) {
       ExternalArrayType type = array->type();
       uint32_t byte_length;
-      if (array->byte_length()->ToUint32(&byte_length)) {
+      if (array->byte_length()->ToUint32(&byte_length) &&
+          byte_length <= static_cast<uint32_t>(kMaxInt)) {
         Handle<ExternalArray> elements =
             Handle<ExternalArray>::cast(handle(array->elements()));
         Node* pointer = jsgraph()->IntPtrConstant(
@@ -603,7 +604,8 @@ Reduction JSTypedLowering::ReduceJSStoreProperty(Node* node) {
     if (IsExternalArrayElementsKind(array->map()->elements_kind())) {
       ExternalArrayType type = array->type();
       uint32_t byte_length;
-      if (array->byte_length()->ToUint32(&byte_length)) {
+      if (array->byte_length()->ToUint32(&byte_length) &&
+          byte_length <= static_cast<uint32_t>(kMaxInt)) {
         Handle<ExternalArray> elements =
             Handle<ExternalArray>::cast(handle(array->elements()));
         Node* pointer = jsgraph()->IntPtrConstant(